{
  "statistics": {
    "processing": [
      {
        "name": "CAPE",
        "time": 0.0
      },
      {
        "name": "AnalysisInfo",
        "time": 0.018
      },
      {
        "name": "BehaviorAnalysis",
        "time": 0.022
      },
      {
        "name": "Debug",
        "time": 0.0
      },
      {
        "name": "NetworkAnalysis",
        "time": 0.319
      },
      {
        "name": "UrlAnalysis",
        "time": 0.506
      },
      {
        "name": "script_log_processing",
        "time": 0.0
      },
      {
        "name": "ProcessMemory",
        "time": 0.0
      }
    ],
    "signatures": [
      {
        "name": "packer_themida",
        "time": 0.0
      },
      {
        "name": "stealth_network",
        "time": 0.0
      },
      {
        "name": "disable_driver_via_blocklist",
        "time": 0.0
      },
      {
        "name": "disable_driver_via_hvcidisallowedimages",
        "time": 0.0
      },
      {
        "name": "disable_hypervisor_protected_code_integrity",
        "time": 0.0
      },
      {
        "name": "pendingfilerenameoperations_Operations",
        "time": 0.0
      },
      {
        "name": "anomalous_deletefile",
        "time": 0.0
      },
      {
        "name": "antiav_360_libs",
        "time": 0.0
      },
      {
        "name": "antiav_ahnlab_libs",
        "time": 0.0
      },
      {
        "name": "antiav_avast_libs",
        "time": 0.0
      },
      {
        "name": "antiav_bitdefender_libs",
        "time": 0.0
      },
      {
        "name": "antiav_bullguard_libs",
        "time": 0.0
      },
      {
        "name": "antiav_emsisoft_libs",
        "time": 0.0
      },
      {
        "name": "antiav_qurb_libs",
        "time": 0.0
      },
      {
        "name": "antiav_servicestop",
        "time": 0.0
      },
      {
        "name": "antiav_apioverride_libs",
        "time": 0.0
      },
      {
        "name": "antidebug_guardpages",
        "time": 0.0
      },
      {
        "name": "antiav_nthookengine_libs",
        "time": 0.0
      },
      {
        "name": "antidebug_outputdebugstring",
        "time": 0.0
      },
      {
        "name": "antidebug_windows",
        "time": 0.0
      },
      {
        "name": "antisandbox_cuckoocrash",
        "time": 0.0
      },
      {
        "name": "antisandbox_foregroundwindows",
        "time": 0.0
      },
      {
        "name": "mouse_movement_detect",
        "time": 0.0
      },
      {
        "name": "antisandbox_sboxie_libs",
        "time": 0.0
      },
      {
        "name": "antisandbox_script_timer",
        "time": 0.0
      },
      {
        "name": "antisandbox_sleep",
        "time": 0.0
      },
      {
        "name": "antisandbox_sunbelt_libs",
        "time": 0.0
      },
      {
        "name": "antisandbox_unhook",
        "time": 0.0
      },
      {
        "name": "hardware_id_profiling",
        "time": 0.0
      },
      {
        "name": "antivm_directory_objects",
        "time": 0.0
      },
      {
        "name": "antivm_display",
        "time": 0.0
      },
      {
        "name": "antivm_generic_disk",
        "time": 0.0
      },
      {
        "name": "antivm_generic_system",
        "time": 0.0
      },
      {
        "name": "antivm_checks_available_memory",
        "time": 0.0
      },
      {
        "name": "detect_virtualization_via_recent_files",
        "time": 0.0
      },
      {
        "name": "antivm_vbox_libs",
        "time": 0.0
      },
      {
        "name": "antivm_vmware_events",
        "time": 0.0
      },
      {
        "name": "antivm_vmware_libs",
        "time": 0.0
      },
      {
        "name": "antivm_wmi",
        "time": 0.0
      },
      {
        "name": "api_spamming",
        "time": 0.0
      },
      {
        "name": "api_uuidfromstringa",
        "time": 0.0
      },
      {
        "name": "bcdedit_command",
        "time": 0.0
      },
      {
        "name": "bootkit",
        "time": 0.0
      },
      {
        "name": "direct_hdd_access",
        "time": 0.0
      },
      {
        "name": "physical_drive_access",
        "time": 0.0
      },
      {
        "name": "potential_overwrite_mbr",
        "time": 0.0
      },
      {
        "name": "read_file_raw_disk_access",
        "time": 0.0
      },
      {
        "name": "suspicious_iocontrol_codes",
        "time": 0.0
      },
      {
        "name": "browser_needed",
        "time": 0.0
      },
      {
        "name": "amsi_enumeration",
        "time": 0.0
      },
      {
        "name": "regsvr32_squiblydoo_dll_load",
        "time": 0.0
      },
      {
        "name": "suspicious_ntdll_disk_load",
        "time": 0.0
      },
      {
        "name": "direct_syscall_evasion",
        "time": 0.0
      },
      {
        "name": "unbacked_syscall_execution",
        "time": 0.0
      },
      {
        "name": "uac_bypass_cmstp",
        "time": 0.0
      },
      {
        "name": "uac_bypass_eventvwr",
        "time": 0.0
      },
      {
        "name": "uac_bypass_windows_Backup",
        "time": 0.0
      },
      {
        "name": "privilege_elevation_check",
        "time": 0.0
      },
      {
        "name": "queries_computer_name",
        "time": 0.0
      },
      {
        "name": "queries_user_name",
        "time": 0.0
      },
      {
        "name": "creates_largekey",
        "time": 0.0
      },
      {
        "name": "creates_nullvalue",
        "time": 0.0
      },
      {
        "name": "access_windows_passwords_vault",
        "time": 0.0
      },
      {
        "name": "dump_lsa_via_windows_error_reporting",
        "time": 0.0
      },
      {
        "name": "lsass_credential_dumping",
        "time": 0.0
      },
      {
        "name": "critical_process",
        "time": 0.0
      },
      {
        "name": "query_fips_reconnaissance",
        "time": 0.0
      },
      {
        "name": "cryptopool_domains",
        "time": 0.0
      },
      {
        "name": "dead_connect",
        "time": 0.0
      },
      {
        "name": "dead_link",
        "time": 0.0
      },
      {
        "name": "debugs_self",
        "time": 0.0
      },
      {
        "name": "decoy_image",
        "time": 0.0
      },
      {
        "name": "deletes_consolehost_history",
        "time": 0.0
      },
      {
        "name": "deletes_shadow_copies",
        "time": 0.0
      },
      {
        "name": "deletes_system_state_backup",
        "time": 0.0
      },
      {
        "name": "dep_bypass",
        "time": 0.0
      },
      {
        "name": "dep_disable",
        "time": 0.0
      },
      {
        "name": "disables_mappeddrives_autodisconnect",
        "time": 0.0
      },
      {
        "name": "disables_wfp",
        "time": 0.0
      },
      {
        "name": "add_windows_defender_exclusions",
        "time": 0.0
      },
      {
        "name": "mountpoints_volume_discovery",
        "time": 0.0
      },
      {
        "name": "dll_load_uncommon_file_types",
        "time": 0.0
      },
      {
        "name": "dllload_suspicious_directory",
        "time": 0.0
      },
      {
        "name": "document_script_exe_drop",
        "time": 0.0
      },
      {
        "name": "driver_load",
        "time": 0.0
      },
      {
        "name": "install_kernel_driver_service",
        "time": 0.0
      },
      {
        "name": "malformed_dll_loading",
        "time": 0.0
      },
      {
        "name": "dynamic_function_loading",
        "time": 0.0
      },
      {
        "name": "registers_vectored_exception_handler",
        "time": 0.0
      },
      {
        "name": "exec_crash",
        "time": 0.0
      },
      {
        "name": "process_creation_suspicious_location",
        "time": 0.0
      },
      {
        "name": "exploit_getbasekerneladdress",
        "time": 0.0
      },
      {
        "name": "exploit_gethaldispatchtable",
        "time": 0.0
      },
      {
        "name": "exploit_heapspray",
        "time": 0.0
      },
      {
        "name": "downloads_from_filehosting",
        "time": 0.0
      },
      {
        "name": "generic_phish",
        "time": 0.0
      },
      {
        "name": "http_request",
        "time": 0.0
      },
      {
        "name": "infostealer_browser",
        "time": 0.0
      },
      {
        "name": "infostealer_browser_password",
        "time": 0.0
      },
      {
        "name": "infostealer_cookies",
        "time": 0.0
      },
      {
        "name": "captures_screenshot",
        "time": 0.0
      },
      {
        "name": "injection_createremotethread",
        "time": 0.0
      },
      {
        "name": "creates_suspended_process",
        "time": 0.0
      },
      {
        "name": "injection_module_stomping_probing",
        "time": 0.0
      },
      {
        "name": "injection_needextension",
        "time": 0.0
      },
      {
        "name": "injection_network_traffic",
        "time": 0.0
      },
      {
        "name": "injection_runpe",
        "time": 0.0
      },
      {
        "name": "section_mapping_injection",
        "time": 0.0
      },
      {
        "name": "injection_themeinitapihook",
        "time": 0.0
      },
      {
        "name": "apc_injection",
        "time": 0.0
      },
      {
        "name": "resumethread_remote_process",
        "time": 0.0
      },
      {
        "name": "injection_write_exe_process",
        "time": 0.0
      },
      {
        "name": "injection_write_process",
        "time": 0.0
      },
      {
        "name": "internet_dropper",
        "time": 0.0
      },
      {
        "name": "interprocess_comms_mutex",
        "time": 0.0
      },
      {
        "name": "interprocess_comms_named_pipe",
        "time": 0.0
      },
      {
        "name": "interprocess_comms_shared_memory",
        "time": 0.0
      },
      {
        "name": "escalate_privilege_via_named_pipe",
        "time": 0.0
      },
      {
        "name": "ipc_namedpipe",
        "time": 0.0
      },
      {
        "name": "js_phish",
        "time": 0.0
      },
      {
        "name": "js_suspicious_redirect",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_internet_explorer_exporter",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_run_exe_helper_utility",
        "time": 0.0
      },
      {
        "name": "execute_ps_via_syncappvpublishingserver",
        "time": 0.0
      },
      {
        "name": "malicious_dynamic_function_loading",
        "time": 0.0
      },
      {
        "name": "reads_memory_remote_process",
        "time": 0.0
      },
      {
        "name": "unbacked_exception_filter",
        "time": 0.0
      },
      {
        "name": "unbacked_process_mitigation_alteration",
        "time": 0.0
      },
      {
        "name": "thread_unbacked_memory",
        "time": 0.0
      },
      {
        "name": "unbacked_api_resolution",
        "time": 0.0
      },
      {
        "name": "unbacked_dotnet_execution",
        "time": 0.0
      },
      {
        "name": "unbacked_library_load",
        "time": 0.0
      },
      {
        "name": "unbacked_memory_apc_execution",
        "time": 0.0
      },
      {
        "name": "unbacked_memory_protection_alteration",
        "time": 0.0
      },
      {
        "name": "unbacked_mutex_creation",
        "time": 0.0
      },
      {
        "name": "unbacked_process_creation",
        "time": 0.0
      },
      {
        "name": "unbacked_veh_registration",
        "time": 0.0
      },
      {
        "name": "unbacked_com_instantiation",
        "time": 0.0
      },
      {
        "name": "unbacked_crypto_operations",
        "time": 0.0
      },
      {
        "name": "unbacked_delay_execution",
        "time": 0.0
      },
      {
        "name": "unbacked_file_dropping",
        "time": 0.0
      },
      {
        "name": "unbacked_process_enumeration",
        "time": 0.0
      },
      {
        "name": "unbacked_registry_modification",
        "time": 0.0
      },
      {
        "name": "unbacked_service_manipulation",
        "time": 0.0
      },
      {
        "name": "unbacked_token_manipulation",
        "time": 0.0
      },
      {
        "name": "unbacked_wmi_execution",
        "time": 0.0
      },
      {
        "name": "unbacked_bind_shell",
        "time": 0.0
      },
      {
        "name": "unbacked_dns_resolution",
        "time": 0.0
      },
      {
        "name": "unbacked_memory_network_connection",
        "time": 0.0
      },
      {
        "name": "unbacked_named_pipe_creation",
        "time": 0.0
      },
      {
        "name": "unbacked_useragent_retrieval",
        "time": 0.0
      },
      {
        "name": "mimics_filetime",
        "time": 0.0
      },
      {
        "name": "amsi_bypass_via_com_registry",
        "time": 0.0
      },
      {
        "name": "access_auto_logons_via_registry",
        "time": 0.0
      },
      {
        "name": "access_boot_key_via_registry",
        "time": 0.0
      },
      {
        "name": "create_suspicious_lnk_files",
        "time": 0.0
      },
      {
        "name": "credential_access_via_windows_credential_history",
        "time": 0.0
      },
      {
        "name": "dll_hijacking_via_microsoft_exchange",
        "time": 0.0
      },
      {
        "name": "dll_hijacking_via_waas_medic_svc_com_typelib",
        "time": 0.0
      },
      {
        "name": "execute_file_downloaded_via_openssh",
        "time": 0.0
      },
      {
        "name": "execute_safe_mode_from_suspicious_process",
        "time": 0.0
      },
      {
        "name": "execute_scripts_via_microsoft_management_console",
        "time": 0.0
      },
      {
        "name": "execute_suspicious_processes_via_windows_mssql_service",
        "time": 0.0
      },
      {
        "name": "execution_from_self_extracting_archive",
        "time": 0.0
      },
      {
        "name": "ip_address_discovery_via_trusted_program",
        "time": 0.0
      },
      {
        "name": "load_dll_via_control_panel",
        "time": 0.0
      },
      {
        "name": "network_connection_via_suspicious_process",
        "time": 0.0
      },
      {
        "name": "potential_location_discovery_via_unusual_process",
        "time": 0.0
      },
      {
        "name": "store_executable_registry",
        "time": 0.0
      },
      {
        "name": "Suspicious_Execution_Via_MicrosoftExchangeTransportAgent",
        "time": 0.0
      },
      {
        "name": "suspicious_java_execution_via_win_scripts",
        "time": 0.0
      },
      {
        "name": "Suspicious_Scheduled_Task_Creation_Via_Masqueraded_XML_File",
        "time": 0.0
      },
      {
        "name": "uses_restart_manager_for_suspicious_activities",
        "time": 0.0
      },
      {
        "name": "modify_desktop_wallpaper",
        "time": 0.0
      },
      {
        "name": "modify_zoneid_ads",
        "time": 0.0
      },
      {
        "name": "move_file_on_reboot",
        "time": 0.0
      },
      {
        "name": "multiple_useragents",
        "time": 0.0
      },
      {
        "name": "network_anomaly",
        "time": 0.0
      },
      {
        "name": "network_bind",
        "time": 0.0
      },
      {
        "name": "etherhiding_smart_contract_call",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_archive",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_free_webhosting",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_generic",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_interactsh",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_opensource",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_pastesite",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_payload",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_serviceinterface",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_socialmedia",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_telegram",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_tempstorage",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_temp_urldns",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_urlshortener",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_useragent",
        "time": 0.0
      },
      {
        "name": "network_cnc_smtps_exfil",
        "time": 0.0
      },
      {
        "name": "network_cnc_smtps_generic",
        "time": 0.0
      },
      {
        "name": "network_dns_idn",
        "time": 0.0
      },
      {
        "name": "network_dns_suspicious_querytype",
        "time": 0.0
      },
      {
        "name": "network_dns_tunneling_request",
        "time": 0.0
      },
      {
        "name": "explorer_http",
        "time": 0.0
      },
      {
        "name": "network_fake_useragent",
        "time": 0.0
      },
      {
        "name": "legitimate_domain_abuse",
        "time": 0.0
      },
      {
        "name": "suspicious_communication_trusted_site",
        "time": 0.0
      },
      {
        "name": "network_tor",
        "time": 0.0
      },
      {
        "name": "office_com_load",
        "time": 0.0
      },
      {
        "name": "office_dotnet_load",
        "time": 0.0
      },
      {
        "name": "office_mshtml_load",
        "time": 0.0
      },
      {
        "name": "office_vb_load",
        "time": 0.0
      },
      {
        "name": "office_wmi_load",
        "time": 0.0
      },
      {
        "name": "office_cve2017_11882_network",
        "time": 0.0
      },
      {
        "name": "office_cve_2021_40444",
        "time": 0.0
      },
      {
        "name": "office_cve_2021_40444_m2",
        "time": 0.0
      },
      {
        "name": "office_flash_load",
        "time": 0.0
      },
      {
        "name": "office_postscript",
        "time": 0.0
      },
      {
        "name": "office_suspicious_processes",
        "time": 0.0
      },
      {
        "name": "decompress_exe",
        "time": 0.0
      },
      {
        "name": "persistence_via_autodial_dll_registry",
        "time": 0.0
      },
      {
        "name": "persistence_autorun",
        "time": 0.0
      },
      {
        "name": "persistence_autorun_tasks",
        "time": 0.0
      },
      {
        "name": "persistence_bootexecute",
        "time": 0.0
      },
      {
        "name": "persistence_registry_script",
        "time": 0.0
      },
      {
        "name": "powershell_download",
        "time": 0.0
      },
      {
        "name": "powershell_request",
        "time": 0.0
      },
      {
        "name": "createtoolhelp32snapshot_module_enumeration",
        "time": 0.0
      },
      {
        "name": "enumerates_running_processes",
        "time": 0.0
      },
      {
        "name": "process_interest",
        "time": 0.0
      },
      {
        "name": "process_needed",
        "time": 0.0
      },
      {
        "name": "ransomware_iocp_asynchronous_encryption",
        "time": 0.0
      },
      {
        "name": "kernel_crypto_driver_abuse",
        "time": 0.0
      },
      {
        "name": "mass_data_encryption",
        "time": 0.0
      },
      {
        "name": "ransomware_extension_hijack",
        "time": 0.0
      },
      {
        "name": "mass_file_modification_access",
        "time": 0.0
      },
      {
        "name": "ransomware_attribute_stripping",
        "time": 0.0
      },
      {
        "name": "ransomware_file_modifications",
        "time": 0.0
      },
      {
        "name": "mass_ransom_note_drop",
        "time": 0.0
      },
      {
        "name": "ransomware_message",
        "time": 0.0
      },
      {
        "name": "recon_beacon",
        "time": 0.0
      },
      {
        "name": "recon_programs",
        "time": 0.0
      },
      {
        "name": "recon_systeminfo",
        "time": 0.0
      },
      {
        "name": "accesses_recyclebin",
        "time": 0.0
      },
      {
        "name": "script_created_process",
        "time": 0.0
      },
      {
        "name": "script_network_activity",
        "time": 0.0
      },
      {
        "name": "suspicious_js_script",
        "time": 0.0
      },
      {
        "name": "javascript_timer",
        "time": 0.0
      },
      {
        "name": "secure_login_phishing",
        "time": 0.0
      },
      {
        "name": "securityxploded_modules",
        "time": 0.0
      },
      {
        "name": "get_clipboard_data",
        "time": 0.0
      },
      {
        "name": "sets_autoconfig_url",
        "time": 0.0
      },
      {
        "name": "spoofs_procname",
        "time": 0.0
      },
      {
        "name": "stack_pivot",
        "time": 0.0
      },
      {
        "name": "stack_pivot_file_created",
        "time": 0.0
      },
      {
        "name": "stack_pivot_process_create",
        "time": 0.0
      },
      {
        "name": "set_clipboard_data",
        "time": 0.0
      },
      {
        "name": "stealth_childproc",
        "time": 0.0
      },
      {
        "name": "stealth_system_procname",
        "time": 0.0
      },
      {
        "name": "stealth_window",
        "time": 0.0
      },
      {
        "name": "queries_keyboard_layout",
        "time": 0.0
      },
      {
        "name": "queries_locale_api",
        "time": 0.0
      },
      {
        "name": "terminates_remote_process",
        "time": 0.0
      },
      {
        "name": "uiautomationcore_load",
        "time": 0.0
      },
      {
        "name": "user_enum",
        "time": 0.0
      },
      {
        "name": "mmc_dll_script_load",
        "time": 0.0
      },
      {
        "name": "mmc_dotnet_load",
        "time": 0.0
      },
      {
        "name": "virus",
        "time": 0.0
      },
      {
        "name": "webmail_phish",
        "time": 0.0
      },
      {
        "name": "persists_dev_util",
        "time": 0.0
      },
      {
        "name": "spawns_dev_util",
        "time": 0.0
      },
      {
        "name": "alters_windows_utility",
        "time": 0.0
      },
      {
        "name": "overwrites_accessibility_utility",
        "time": 0.0
      },
      {
        "name": "Potential_Lateral_Movement_Via_SMBEXEC",
        "time": 0.0
      },
      {
        "name": "potential_WebShell_Via_ScreenConnectServer",
        "time": 0.0
      },
      {
        "name": "uses_Microsoft_HTML_Help_Executable",
        "time": 0.0
      },
      {
        "name": "wiper_zeroedbytes",
        "time": 0.0
      },
      {
        "name": "wmi_create_process",
        "time": 0.0
      },
      {
        "name": "wmi_script_process",
        "time": 0.0
      },
      {
        "name": "deletes_files",
        "time": 0.0
      },
      {
        "name": "drops_files",
        "time": 0.0
      },
      {
        "name": "reads_files",
        "time": 0.0
      },
      {
        "name": "writes_files",
        "time": 0.0
      },
      {
        "name": "antianalysis_tls_section",
        "time": 0.0
      },
      {
        "name": "antivirus_clamav",
        "time": 0.0
      },
      {
        "name": "antivirus_virustotal",
        "time": 0.0
      },
      {
        "name": "bad_certs",
        "time": 0.0
      },
      {
        "name": "bad_ssl_certs",
        "time": 0.0
      },
      {
        "name": "banker_zeus_p2p",
        "time": 0.0
      },
      {
        "name": "banker_zeus_url",
        "time": 0.0
      },
      {
        "name": "bot_athenahttp",
        "time": 0.0
      },
      {
        "name": "bot_dirtjumper",
        "time": 0.0
      },
      {
        "name": "bot_drive",
        "time": 0.0
      },
      {
        "name": "bot_drive2",
        "time": 0.0
      },
      {
        "name": "bot_madness",
        "time": 0.0
      },
      {
        "name": "byod_loldrivers_match",
        "time": 0.0
      },
      {
        "name": "byod_novel_driver",
        "time": 0.0
      },
      {
        "name": "byod_post_load_exploitation",
        "time": 0.0
      },
      {
        "name": "byod_driver_service_install",
        "time": 0.0
      },
      {
        "name": "com_spawned_process",
        "time": 0.0
      },
      {
        "name": "family_proxyback",
        "time": 0.0
      },
      {
        "name": "flare_capa_antianalysis",
        "time": 0.0
      },
      {
        "name": "flare_capa_collection",
        "time": 0.0
      },
      {
        "name": "flare_capa_communication",
        "time": 0.0
      },
      {
        "name": "flare_capa_compiler",
        "time": 0.0
      },
      {
        "name": "flare_capa_datamanipulation",
        "time": 0.0
      },
      {
        "name": "flare_capa_executable",
        "time": 0.0
      },
      {
        "name": "flare_capa_hostinteraction",
        "time": 0.0
      },
      {
        "name": "flare_capa_impact",
        "time": 0.0
      },
      {
        "name": "flare_capa_lib",
        "time": 0.0
      },
      {
        "name": "flare_capa_linking",
        "time": 0.0
      },
      {
        "name": "flare_capa_loadcode",
        "time": 0.0
      },
      {
        "name": "flare_capa_malwarefamily",
        "time": 0.0
      },
      {
        "name": "flare_capa_nursery",
        "time": 0.0
      },
      {
        "name": "flare_capa_persistence",
        "time": 0.0
      },
      {
        "name": "flare_capa_runtime",
        "time": 0.0
      },
      {
        "name": "flare_capa_targeting",
        "time": 0.0
      },
      {
        "name": "threatfox",
        "time": 0.0
      },
      {
        "name": "log4shell",
        "time": 0.0
      },
      {
        "name": "mimics_extension",
        "time": 0.0
      },
      {
        "name": "network_ip_exe",
        "time": 0.0
      },
      {
        "name": "network_dga",
        "time": 0.0
      },
      {
        "name": "network_dga_fraunhofer",
        "time": 0.0
      },
      {
        "name": "network_dyndns",
        "time": 0.001
      },
      {
        "name": "network_icmp",
        "time": 0.0
      },
      {
        "name": "network_irc",
        "time": 0.0
      },
      {
        "name": "network_open_proxy",
        "time": 0.0
      },
      {
        "name": "network_smtp",
        "time": 0.0
      },
      {
        "name": "network_torgateway",
        "time": 0.001
      },
      {
        "name": "origin_langid",
        "time": 0.0
      },
      {
        "name": "origin_resource_langid",
        "time": 0.0
      },
      {
        "name": "overlay",
        "time": 0.0
      },
      {
        "name": "pe_deep_entrypoint",
        "time": 0.0
      },
      {
        "name": "packer_unknown_pe_section_name",
        "time": 0.0
      },
      {
        "name": "packer_aspack",
        "time": 0.0
      },
      {
        "name": "packer_aspirecrypt",
        "time": 0.0
      },
      {
        "name": "packer_bedsprotector",
        "time": 0.0
      },
      {
        "name": "packer_confuser",
        "time": 0.0
      },
      {
        "name": "packer_enigma",
        "time": 0.0
      },
      {
        "name": "packer_entropy",
        "time": 0.0
      },
      {
        "name": "packer_mpress",
        "time": 0.0
      },
      {
        "name": "packer_nate",
        "time": 0.0
      },
      {
        "name": "packer_nspack",
        "time": 0.0
      },
      {
        "name": "packer_smartassembly",
        "time": 0.0
      },
      {
        "name": "packer_spices",
        "time": 0.0
      },
      {
        "name": "packer_themida",
        "time": 0.0
      },
      {
        "name": "packer_titan",
        "time": 0.0
      },
      {
        "name": "packer_upx",
        "time": 0.0
      },
      {
        "name": "packer_vmprotect",
        "time": 0.0
      },
      {
        "name": "packer_yoda",
        "time": 0.0
      },
      {
        "name": "pe_cert_invalid_signature",
        "time": 0.0
      },
      {
        "name": "pe_cert_self_signed",
        "time": 0.0
      },
      {
        "name": "pe_cert_suspicious_issuer",
        "time": 0.0
      },
      {
        "name": "punch_plus_plus_pcres",
        "time": 0.0
      },
      {
        "name": "procmem_yara",
        "time": 0.0
      },
      {
        "name": "recon_checkip",
        "time": 0.0
      },
      {
        "name": "sigma_events",
        "time": 0.0
      },
      {
        "name": "static_authenticode",
        "time": 0.0
      },
      {
        "name": "invalid_authenticode_signature",
        "time": 0.0
      },
      {
        "name": "static_dotnet_anomaly",
        "time": 0.0
      },
      {
        "name": "static_java",
        "time": 0.0
      },
      {
        "name": "static_pdf",
        "time": 0.0
      },
      {
        "name": "contains_pe_overlay",
        "time": 0.0
      },
      {
        "name": "static_pe_anomaly",
        "time": 0.0
      },
      {
        "name": "pe_compile_timestomping",
        "time": 0.0
      },
      {
        "name": "static_pe_pdbpath",
        "time": 0.0
      },
      {
        "name": "static_rat_config",
        "time": 0.0
      },
      {
        "name": "static_versioninfo_anomaly",
        "time": 0.0
      },
      {
        "name": "browser_credential_theft_headless",
        "time": 0.0
      },
      {
        "name": "suricata_alert",
        "time": 0.0
      },
      {
        "name": "volatility_devicetree_1",
        "time": 0.0
      },
      {
        "name": "volatility_handles_1",
        "time": 0.0
      },
      {
        "name": "volatility_ldrmodules_1",
        "time": 0.0
      },
      {
        "name": "volatility_ldrmodules_2",
        "time": 0.0
      },
      {
        "name": "volatility_malfind_1",
        "time": 0.0
      },
      {
        "name": "volatility_malfind_2",
        "time": 0.0
      },
      {
        "name": "volatility_modscan_1",
        "time": 0.0
      },
      {
        "name": "volatility_svcscan_1",
        "time": 0.0
      },
      {
        "name": "volatility_svcscan_2",
        "time": 0.0
      },
      {
        "name": "volatility_svcscan_3",
        "time": 0.0
      },
      {
        "name": "whois_create",
        "time": 0.0
      },
      {
        "name": "accesses_mailslot",
        "time": 0.0
      },
      {
        "name": "accesses_netlogon_regkey",
        "time": 0.0
      },
      {
        "name": "accesses_public_folder",
        "time": 0.0
      },
      {
        "name": "accesses_sysvol",
        "time": 0.0
      },
      {
        "name": "writes_sysvol",
        "time": 0.0
      },
      {
        "name": "adds_admin_user",
        "time": 0.0
      },
      {
        "name": "adds_user",
        "time": 0.0
      },
      {
        "name": "overwrites_admin_password",
        "time": 0.0
      },
      {
        "name": "antianalysis_detectfile",
        "time": 0.001
      },
      {
        "name": "antianalysis_detectreg",
        "time": 0.0
      },
      {
        "name": "modify_attachment_manager",
        "time": 0.0
      },
      {
        "name": "antiav_detectfile",
        "time": 0.001
      },
      {
        "name": "antiav_detectreg",
        "time": 0.001
      },
      {
        "name": "antiav_srp",
        "time": 0.0
      },
      {
        "name": "antiav_whitespace",
        "time": 0.0
      },
      {
        "name": "antidebug_devices",
        "time": 0.0
      },
      {
        "name": "antiemu_windefend",
        "time": 0.0
      },
      {
        "name": "antiemu_wine_reg",
        "time": 0.0
      },
      {
        "name": "antisandbox_cuckoo_files",
        "time": 0.0
      },
      {
        "name": "antisandbox_fortinet_files",
        "time": 0.0
      },
      {
        "name": "antisandbox_joe_anubis_files",
        "time": 0.0
      },
      {
        "name": "antisandbox_sboxie_mutex",
        "time": 0.0
      },
      {
        "name": "antisandbox_sunbelt_files",
        "time": 0.0
      },
      {
        "name": "antisandbox_threattrack_files",
        "time": 0.0
      },
      {
        "name": "antivm_bochs_keys",
        "time": 0.0
      },
      {
        "name": "antivm_generic_bios",
        "time": 0.0
      },
      {
        "name": "antivm_generic_diskreg",
        "time": 0.0
      },
      {
        "name": "antivm_hyperv_keys",
        "time": 0.0
      },
      {
        "name": "antivm_parallels_keys",
        "time": 0.0
      },
      {
        "name": "antivm_recentdocs",
        "time": 0.0
      },
      {
        "name": "antivm_vbox_devices",
        "time": 0.0
      },
      {
        "name": "antivm_vbox_files",
        "time": 0.001
      },
      {
        "name": "antivm_vbox_keys",
        "time": 0.0
      },
      {
        "name": "antivm_vmware_devices",
        "time": 0.0
      },
      {
        "name": "antivm_vmware_files",
        "time": 0.0
      },
      {
        "name": "antivm_vmware_keys",
        "time": 0.0
      },
      {
        "name": "antivm_vmware_mutexes",
        "time": 0.0
      },
      {
        "name": "antivm_vpc_files",
        "time": 0.0
      },
      {
        "name": "antivm_vpc_keys",
        "time": 0.0
      },
      {
        "name": "antivm_vpc_mutex",
        "time": 0.0
      },
      {
        "name": "antivm_xen_keys",
        "time": 0.0
      },
      {
        "name": "ketrican_regkeys",
        "time": 0.0
      },
      {
        "name": "bitcoin_opencl",
        "time": 0.0
      },
      {
        "name": "enumerates_physical_drives",
        "time": 0.0
      },
      {
        "name": "bot_russkill",
        "time": 0.0
      },
      {
        "name": "browser_addon",
        "time": 0.0
      },
      {
        "name": "chromium_browser_extension_directory",
        "time": 0.0
      },
      {
        "name": "browser_helper_object",
        "time": 0.0
      },
      {
        "name": "browser_security",
        "time": 0.0
      },
      {
        "name": "browser_startpage",
        "time": 0.0
      },
      {
        "name": "executes_headless_browser",
        "time": 0.0
      },
      {
        "name": "suspicious_browser_arguments",
        "time": 0.0
      },
      {
        "name": "ie_disables_process_tab",
        "time": 0.0
      },
      {
        "name": "odbcconf_bypass",
        "time": 0.001
      },
      {
        "name": "squiblydoo_bypass",
        "time": 0.0
      },
      {
        "name": "squiblytwo_bypass",
        "time": 0.0
      },
      {
        "name": "bypass_chromium_protection",
        "time": 0.0
      },
      {
        "name": "bypass_firewall",
        "time": 0.0
      },
      {
        "name": "checks_uac_status",
        "time": 0.0
      },
      {
        "name": "uac_bypass_cmstpcom",
        "time": 0.0
      },
      {
        "name": "uac_bypass_delegateexecute_sdclt",
        "time": 0.0
      },
      {
        "name": "uac_bypass_fodhelper",
        "time": 0.0
      },
      {
        "name": "cape_extracted_content",
        "time": 0.0
      },
      {
        "name": "clears_logs",
        "time": 0.0
      },
      {
        "name": "cmdline_obfuscation",
        "time": 0.0
      },
      {
        "name": "cmdline_switches",
        "time": 0.0
      },
      {
        "name": "cmdline_terminate",
        "time": 0.0
      },
      {
        "name": "cmdline_forfiles_wildcard",
        "time": 0.0
      },
      {
        "name": "cmdline_http_link",
        "time": 0.0
      },
      {
        "name": "cmdline_long_string",
        "time": 0.0
      },
      {
        "name": "cmdline_reversed_http_link",
        "time": 0.0
      },
      {
        "name": "long_commandline",
        "time": 0.0
      },
      {
        "name": "powershell_renamed_commandline",
        "time": 0.0
      },
      {
        "name": "copies_self",
        "time": 0.0
      },
      {
        "name": "credwiz_credentialaccess",
        "time": 0.0
      },
      {
        "name": "enables_wdigest",
        "time": 0.0
      },
      {
        "name": "vaultcmd_credentialaccess",
        "time": 0.0
      },
      {
        "name": "file_credential_store_access",
        "time": 0.0
      },
      {
        "name": "file_credential_store_write",
        "time": 0.0
      },
      {
        "name": "kerberos_credential_access_via_rubeus",
        "time": 0.0
      },
      {
        "name": "registry_credential_dumping",
        "time": 0.0
      },
      {
        "name": "registry_lsa_secrets_access",
        "time": 0.0
      },
      {
        "name": "comsvcs_credentialdump",
        "time": 0.0
      },
      {
        "name": "cryptomining_stratum_command",
        "time": 0.0
      },
      {
        "name": "deepfreeze_mutex",
        "time": 0.0
      },
      {
        "name": "deletes_executed_files",
        "time": 0.0
      },
      {
        "name": "disables_app_launch",
        "time": 0.0
      },
      {
        "name": "disables_auto_app_termination",
        "time": 0.0
      },
      {
        "name": "disables_appv_virtualization",
        "time": 0.0
      },
      {
        "name": "disables_backups",
        "time": 0.0
      },
      {
        "name": "disables_browser_warn",
        "time": 0.0
      },
      {
        "name": "disables_context_menus",
        "time": 0.0
      },
      {
        "name": "disables_cpl_disable",
        "time": 0.0
      },
      {
        "name": "disables_crashdumps",
        "time": 0.0
      },
      {
        "name": "disables_event_logging",
        "time": 0.0
      },
      {
        "name": "disables_folder_options",
        "time": 0.0
      },
      {
        "name": "disables_notificationcenter",
        "time": 0.0
      },
      {
        "name": "disables_power_options",
        "time": 0.0
      },
      {
        "name": "disables_restore_default_state",
        "time": 0.0
      },
      {
        "name": "disables_run_command",
        "time": 0.0
      },
      {
        "name": "disables_smartscreen",
        "time": 0.0
      },
      {
        "name": "disables_startmenu_search",
        "time": 0.0
      },
      {
        "name": "disables_system_restore",
        "time": 0.0
      },
      {
        "name": "disables_uac",
        "time": 0.0
      },
      {
        "name": "disables_wer",
        "time": 0.0
      },
      {
        "name": "disables_windows_defender",
        "time": 0.0
      },
      {
        "name": "disables_windows_defender_logging",
        "time": 0.001
      },
      {
        "name": "removes_windows_defender_contextmenu",
        "time": 0.001
      },
      {
        "name": "removes_windows_defender_updates",
        "time": 0.0
      },
      {
        "name": "windows_defender_powershell",
        "time": 0.0
      },
      {
        "name": "disables_windows_file_protection",
        "time": 0.0
      },
      {
        "name": "disables_windowsupdate",
        "time": 0.0
      },
      {
        "name": "disables_winfirewall",
        "time": 0.0
      },
      {
        "name": "folder_enumeration",
        "time": 0.0
      },
      {
        "name": "discover_registry_mount_points",
        "time": 0.0
      },
      {
        "name": "adfind_domain_enumeration",
        "time": 0.0
      },
      {
        "name": "domain_enumeration_commands",
        "time": 0.0
      },
      {
        "name": "driver_filtermanager",
        "time": 0.0
      },
      {
        "name": "dropper",
        "time": 0.0
      },
      {
        "name": "dll_archive_execution",
        "time": 0.0
      },
      {
        "name": "lnk_archive_execution",
        "time": 0.0
      },
      {
        "name": "script_archive_execution",
        "time": 0.0
      },
      {
        "name": "excel4_macro_urls",
        "time": 0.0
      },
      {
        "name": "escalate_privilege_via_ntlm_relay",
        "time": 0.0
      },
      {
        "name": "spooler_access",
        "time": 0.0
      },
      {
        "name": "spooler_svc_start",
        "time": 0.0
      },
      {
        "name": "mapped_drives_uac",
        "time": 0.0
      },
      {
        "name": "hides_recycle_bin_icon",
        "time": 0.0
      },
      {
        "name": "infostealer_bitcoin",
        "time": 0.001
      },
      {
        "name": "infostealer_ftp",
        "time": 0.001
      },
      {
        "name": "infostealer_im",
        "time": 0.001
      },
      {
        "name": "infostealer_mail",
        "time": 0.0
      },
      {
        "name": "Evade_Execution_Via_ASPNet_Compiler",
        "time": 0.0
      },
      {
        "name": "Evade_Execute_Via_DeviceCredentialDeployment",
        "time": 0.0
      },
      {
        "name": "Evade_Execution_Via_Filter_Manager_Control",
        "time": 0.0
      },
      {
        "name": "Evade_Execution_Via_Intel_GFXDownloadWrapper",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_appvlp",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_pcalua",
        "time": 0.0
      },
      {
        "name": "Execute_Binary_Via_OpenSSH",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_pcalua",
        "time": 0.0
      },
      {
        "name": "Execute_Binary_Via_PesterPSModule",
        "time": 0.0
      },
      {
        "name": "Execute_Binary_Via_ScriptRunner",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_ttdinject",
        "time": 0.0
      },
      {
        "name": "Execute_Binary_Via_VisualStudioLiveShare",
        "time": 0.0
      },
      {
        "name": "Execute_Msiexec_Via_Explorer",
        "time": 0.0
      },
      {
        "name": "execute_remote_msi",
        "time": 0.0
      },
      {
        "name": "execute_suspicious_powershell_via_runscripthelper",
        "time": 0.0
      },
      {
        "name": "execute_suspicious_powershell_via_sqlps",
        "time": 0.0
      },
      {
        "name": "Indirect_Command_Execution_Via_ConsoleWindowHost",
        "time": 0.0
      },
      {
        "name": "Perform_Malicious_Activities_Via_Headless_Browser",
        "time": 0.0
      },
      {
        "name": "Register_DLL_Via_CertOC",
        "time": 0.0
      },
      {
        "name": "Register_DLL_Via_MSIEXEC",
        "time": 0.0
      },
      {
        "name": "Register_DLL_Via_Odbcconf",
        "time": 0.0
      },
      {
        "name": "Scriptlet_Proxy_Execution_Via_Pubprn",
        "time": 0.0
      },
      {
        "name": "ie_martian_children",
        "time": 0.0
      },
      {
        "name": "office_martian_children",
        "time": 0.0
      },
      {
        "name": "mimics_icon",
        "time": 0.0
      },
      {
        "name": "masquerade_process_name",
        "time": 0.001
      },
      {
        "name": "mimikatz_modules",
        "time": 0.0
      },
      {
        "name": "ms_office_cmd_rce",
        "time": 0.0
      },
      {
        "name": "mount_copy_to_webdav_share",
        "time": 0.0
      },
      {
        "name": "potential_protocol_tunneling_via_legit_utilities",
        "time": 0.0
      },
      {
        "name": "potential_protocol_tunneling_via_qemu",
        "time": 0.0
      },
      {
        "name": "suspicious_execution_via_dotnet_remoting",
        "time": 0.0
      },
      {
        "name": "dotnet_clr_usagelog_regkeys",
        "time": 0.0
      },
      {
        "name": "modify_hostfile",
        "time": 0.0
      },
      {
        "name": "modify_oem_information",
        "time": 0.0
      },
      {
        "name": "modify_security_center_warnings",
        "time": 0.0
      },
      {
        "name": "modify_uac_prompt",
        "time": 0.0
      },
      {
        "name": "network_dns_blockchain",
        "time": 0.0
      },
      {
        "name": "network_dns_opennic",
        "time": 0.0
      },
      {
        "name": "network_dns_paste_site",
        "time": 0.0
      },
      {
        "name": "network_dns_reverse_proxy",
        "time": 0.0
      },
      {
        "name": "network_dns_temp_file_storage",
        "time": 0.0
      },
      {
        "name": "network_dns_temp_urldns",
        "time": 0.0
      },
      {
        "name": "network_dns_url_shortener",
        "time": 0.003
      },
      {
        "name": "network_dns_doh_tls",
        "time": 0.0
      },
      {
        "name": "suspicious_tld",
        "time": 0.002
      },
      {
        "name": "network_tor_service",
        "time": 0.0
      },
      {
        "name": "office_code_page",
        "time": 0.0
      },
      {
        "name": "office_addinloading",
        "time": 0.0
      },
      {
        "name": "office_perfkey",
        "time": 0.0
      },
      {
        "name": "office_macro",
        "time": 0.0
      },
      {
        "name": "changes_trust_center_settings",
        "time": 0.0
      },
      {
        "name": "disables_vba_trust_access",
        "time": 0.0
      },
      {
        "name": "office_macro_autoexecution",
        "time": 0.0
      },
      {
        "name": "office_macro_ioc",
        "time": 0.0
      },
      {
        "name": "office_macro_malicious_prediction",
        "time": 0.0
      },
      {
        "name": "office_macro_suspicious",
        "time": 0.0
      },
      {
        "name": "rtf_aslr_bypass",
        "time": 0.0
      },
      {
        "name": "rtf_anomaly_characterset",
        "time": 0.0
      },
      {
        "name": "rtf_anomaly_version",
        "time": 0.0
      },
      {
        "name": "rtf_embedded_content",
        "time": 0.0
      },
      {
        "name": "rtf_embedded_office_file",
        "time": 0.0
      },
      {
        "name": "rtf_exploit_static",
        "time": 0.0
      },
      {
        "name": "office_security",
        "time": 0.0
      },
      {
        "name": "accesses_office_username",
        "time": 0.0
      },
      {
        "name": "office_anomalous_feature",
        "time": 0.0
      },
      {
        "name": "office_dde_command",
        "time": 0.0
      },
      {
        "name": "packer_armadillo_mutex",
        "time": 0.0
      },
      {
        "name": "packer_armadillo_regkey",
        "time": 0.0
      },
      {
        "name": "persistence_ads",
        "time": 0.0
      },
      {
        "name": "persistence_safeboot",
        "time": 0.0
      },
      {
        "name": "persistence_ifeo",
        "time": 0.0
      },
      {
        "name": "persistence_silent_process_exit",
        "time": 0.0
      },
      {
        "name": "persistence_rdp_registry",
        "time": 0.0
      },
      {
        "name": "persistence_rdp_shadowing",
        "time": 0.0
      },
      {
        "name": "persistence_service",
        "time": 0.0
      },
      {
        "name": "persistence_shim_database",
        "time": 0.0
      },
      {
        "name": "powershell_scriptblock_logging",
        "time": 0.0
      },
      {
        "name": "powershell_command_suspicious",
        "time": 0.0
      },
      {
        "name": "powershell_history_save_mod",
        "time": 0.0
      },
      {
        "name": "powershell_renamed",
        "time": 0.0
      },
      {
        "name": "powershell_reversed",
        "time": 0.0
      },
      {
        "name": "powershell_variable_obfuscation",
        "time": 0.0
      },
      {
        "name": "prevents_safeboot",
        "time": 0.0
      },
      {
        "name": "cmdline_process_discovery",
        "time": 0.0
      },
      {
        "name": "ransomware_extensions_generic",
        "time": 0.0
      },
      {
        "name": "ransomware_extensions_known",
        "time": 0.001
      },
      {
        "name": "ransomware_files",
        "time": 0.002
      },
      {
        "name": "ransomware_recyclebin",
        "time": 0.0
      },
      {
        "name": "ransomware_revil_regkey",
        "time": 0.0
      },
      {
        "name": "reads_password_database",
        "time": 0.0
      },
      {
        "name": "recon_fingerprint",
        "time": 0.0
      },
      {
        "name": "rdptcp_key",
        "time": 0.0
      },
      {
        "name": "uses_rdp_clip",
        "time": 0.0
      },
      {
        "name": "uses_remote_desktop_session",
        "time": 0.0
      },
      {
        "name": "removes_networking_icon",
        "time": 0.0
      },
      {
        "name": "removes_pinned_programs",
        "time": 0.0
      },
      {
        "name": "removes_security_maintenance_icon",
        "time": 0.0
      },
      {
        "name": "removes_startmenu_defaults",
        "time": 0.0
      },
      {
        "name": "removes_username_startmenu",
        "time": 0.0
      },
      {
        "name": "sniffer_winpcap",
        "time": 0.0
      },
      {
        "name": "spreading_autoruninf",
        "time": 0.0
      },
      {
        "name": "stealth_hidden_extension",
        "time": 0.0
      },
      {
        "name": "stealth_hiddenreg",
        "time": 0.0
      },
      {
        "name": "stealth_hide_notifications",
        "time": 0.0
      },
      {
        "name": "stealth_webhistory",
        "time": 0.0
      },
      {
        "name": "sysinternals_psexec",
        "time": 0.0
      },
      {
        "name": "sysinternals_tools",
        "time": 0.0
      },
      {
        "name": "language_check_registry",
        "time": 0.0
      },
      {
        "name": "tampers_etw",
        "time": 0.0
      },
      {
        "name": "lsa_tampering",
        "time": 0.0
      },
      {
        "name": "tampers_powershell_logging",
        "time": 0.0
      },
      {
        "name": "territorial_disputes_sigs",
        "time": 0.001
      },
      {
        "name": "uses_adfind",
        "time": 0.0
      },
      {
        "name": "uses_ms_protocol",
        "time": 0.0
      },
      {
        "name": "owa_web_shell_files",
        "time": 0.0
      },
      {
        "name": "web_shell_files",
        "time": 0.0
      },
      {
        "name": "web_shell_processes",
        "time": 0.0
      },
      {
        "name": "dotnet_csc_build",
        "time": 0.0
      },
      {
        "name": "mavinject_lolbin",
        "time": 0.0
      },
      {
        "name": "multiple_explorer_instances",
        "time": 0.0
      },
      {
        "name": "script_tool_executed",
        "time": 0.0
      },
      {
        "name": "suspicious_certutil_use",
        "time": 0.0
      },
      {
        "name": "suspicious_command_tools",
        "time": 0.003
      },
      {
        "name": "suspicious_mpcmdrun_use",
        "time": 0.0
      },
      {
        "name": "suspicious_ping_use",
        "time": 0.0
      },
      {
        "name": "uses_powershell_copyitem",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities",
        "time": 0.004
      },
      {
        "name": "uses_windows_utilities_appcmd",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_csvde_ldifde",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_cipher",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_clickonce",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_curl",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_dsquery",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_esentutl",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_finger",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_mode",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_ntdsutil",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_nltest",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_setx",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_xcopy",
        "time": 0.0
      },
      {
        "name": "wmic_command_suspicious",
        "time": 0.0
      },
      {
        "name": "scrcons_wmi_script_consumer",
        "time": 0.0
      }
    ],
    "reporting": [
      {
        "name": "BinGraph",
        "time": 0.0
      }
    ]
  },
  "CAPE": {
    "payloads": [],
    "configs": []
  },
  "info": {
    "version": "2.5",
    "started": "2026-05-29 05:23:50",
    "ended": "2026-05-29 05:24:27",
    "duration": 37,
    "id": 40,
    "category": "url",
    "custom": "",
    "machine": {
      "id": 36,
      "status": "stopping",
      "name": "cuckoo1",
      "label": "cuckoo1",
      "platform": "windows",
      "manager": "KVM",
      "started_on": "2026-05-29 05:23:50",
      "shutdown_on": "2026-05-29 05:24:26"
    },
    "package": "edge",
    "timeout": false,
    "tlp": null,
    "parent_sample": null,
    "options": {
      "interactive": "1",
      "nohuman": "yes",
      "vnc_port": "5910"
    },
    "source_url": null,
    "route": "none",
    "user_id": 1,
    "CAPE_current_commit": "e261551257b77d1ae36b689efcf9b3d0af4476c2"
  },
  "behavior": {
    "processes": [
      {
        "process_id": 4484,
        "process_name": "explorer.exe",
        "parent_id": 4364,
        "module_path": "C:\\Windows\\explorer.exe",
        "first_seen": "2026-05-29 09:23:56,618",
        "calls": [
          {
            "timestamp": "2026-05-29 09:23:56,774",
            "thread_id": "4576",
            "caller": "0x7fff59926aa3",
            "parentcaller": "0x7fff59fb2dc9",
            "category": "threading",
            "api": "NtQueueApcThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessId",
                "value": "4484"
              },
              {
                "name": "ThreadId",
                "value": "4968"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000022f8"
              },
              {
                "name": "ApcRoutine",
                "value": "0x7fff5992ded0"
              },
              {
                "name": "Module",
                "value": "sechost.dll"
              }
            ],
            "repeated": 0,
            "id": 0
          },
          {
            "timestamp": "2026-05-29 09:23:57,087",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000c84"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001838"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1
          },
          {
            "timestamp": "2026-05-29 09:23:57,087",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001838"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f1f0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 2
          },
          {
            "timestamp": "2026-05-29 09:23:57,087",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000c84"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000c84"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 3
          },
          {
            "timestamp": "2026-05-29 09:23:57,087",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000025b8"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000da8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 4
          },
          {
            "timestamp": "2026-05-29 09:23:57,087",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000da8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f1f0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 5
          },
          {
            "timestamp": "2026-05-29 09:23:57,087",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000025b8"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000025b8"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 6
          },
          {
            "timestamp": "2026-05-29 09:23:57,087",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002a78"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000025b8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 7
          },
          {
            "timestamp": "2026-05-29 09:23:57,087",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000025b8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f1f0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 8
          },
          {
            "timestamp": "2026-05-29 09:23:57,087",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002a78"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002a78"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 9
          },
          {
            "timestamp": "2026-05-29 09:23:57,087",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002aac"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002a78"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 10
          },
          {
            "timestamp": "2026-05-29 09:23:57,087",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002a78"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f1f0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 11
          },
          {
            "timestamp": "2026-05-29 09:23:57,087",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002aac"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002aac"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 12
          },
          {
            "timestamp": "2026-05-29 09:23:57,087",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002a64"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002aac"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 13
          },
          {
            "timestamp": "2026-05-29 09:23:57,087",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002aac"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f1f0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 14
          },
          {
            "timestamp": "2026-05-29 09:23:57,087",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 15
          },
          {
            "timestamp": "2026-05-29 09:23:57,087",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 16
          },
          {
            "timestamp": "2026-05-29 09:23:57,087",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 17
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 18
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 19
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 20
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 21
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 22
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 23
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 24
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 25
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 26
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 27
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 28
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 29
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 30
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 31
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 32
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 33
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 34
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 35
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 36
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 37
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 38
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 39
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 40
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 41
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 42
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 43
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 44
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 45
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 46
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 47
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 48
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 49
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 50
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 51
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 52
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 53
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 54
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 55
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 56
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 57
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 58
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 59
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 60
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 61
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 62
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 63
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 64
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 65
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 66
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 67
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 68
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 69
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 70
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 71
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 72
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 73
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 74
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 75
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "289AF617-1CC3-42A6-926C-E6A863F0E3BA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 76
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 77
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "35786D3C-B075-49B9-88DD-029876E11C01"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 78
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001124"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 79
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff5588d4e4",
            "parentcaller": "0x7fff557c3285",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00f9d281"
              },
              {
                "name": "Buffer",
                "value": "\\x01"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 80
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001124"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\desktop.ini"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 81
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff5588d4e4",
            "parentcaller": "0x7fff557c348f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00f9d281"
              },
              {
                "name": "Buffer",
                "value": "\\x00"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 82
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001124"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 83
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001124"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 84
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001124"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 85
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001124"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 86
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff5588d4e4",
            "parentcaller": "0x7fff557c3285",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00f9d281"
              },
              {
                "name": "Buffer",
                "value": "\\x01"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 87
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000001"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\desktop.ini"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 88
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff5588d4e4",
            "parentcaller": "0x7fff557c348f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00f9d281"
              },
              {
                "name": "Buffer",
                "value": "\\x00"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 89
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001124"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 90
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001124"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 91
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 92
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "289AF617-1CC3-42A6-926C-E6A863F0E3BA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 93
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 94
          },
          {
            "timestamp": "2026-05-29 09:23:57,102",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "35786D3C-B075-49B9-88DD-029876E11C01"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 95
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff59f5ed8a",
            "parentcaller": "0x7fff59f7db07",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0bcaf000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 96
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 97
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 98
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 99
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 100
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 101
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 102
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 103
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 104
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 105
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 106
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 107
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 108
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 109
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 110
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 111
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 112
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 113
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 114
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 115
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 116
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 117
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 118
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 119
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 120
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 121
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 122
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 123
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 124
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 125
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 126
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 127
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 128
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 129
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 130
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 131
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 132
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 133
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 134
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 135
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 136
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 137
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 138
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 139
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 140
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 141
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 142
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 143
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 144
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 145
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 146
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 147
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 148
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 149
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 150
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 151
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 152
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 153
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 154
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 155
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 156
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 157
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 158
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 159
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 160
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 161
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 162
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 163
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 164
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 165
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 166
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 167
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 168
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 169
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 170
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 171
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 172
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 173
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 174
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 175
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 176
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 177
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 178
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 179
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 180
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 181
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 182
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 183
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 184
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 185
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 186
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 187
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 188
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002a64"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002a64"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 189
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000ef8"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002a64"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 190
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002a64"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f250"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 191
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000ef8"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000ef8"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 192
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002a74"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000ef8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 193
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000ef8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f250"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 194
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002a74"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002a74"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 195
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002524"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002a74"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 196
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002a74"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f1f0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 197
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 198
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 199
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 200
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 201
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 202
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 203
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 204
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 205
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 206
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 207
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 208
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 209
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 210
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 211
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 212
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 213
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 214
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 215
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 216
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 217
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 218
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 219
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 220
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 221
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 222
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 223
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 224
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 225
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 226
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 227
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 228
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 229
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 230
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 231
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 232
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 233
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 234
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 235
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 236
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 237
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 238
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 239
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 240
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 241
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 242
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 243
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 244
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 245
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 246
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 247
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 248
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 249
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 250
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 251
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 252
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 253
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 254
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 255
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 256
          },
          {
            "timestamp": "2026-05-29 09:23:57,133",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 257
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 258
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "289AF617-1CC3-42A6-926C-E6A863F0E3BA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 259
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 260
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "35786D3C-B075-49B9-88DD-029876E11C01"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 261
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 262
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "289AF617-1CC3-42A6-926C-E6A863F0E3BA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 263
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 264
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "35786D3C-B075-49B9-88DD-029876E11C01"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 265
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 266
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 267
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 268
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 269
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 270
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 271
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 272
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 273
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 274
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 275
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 276
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 277
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 278
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 279
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 280
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 281
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 282
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 283
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 284
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 285
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 286
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 287
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 288
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 289
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 290
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 291
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 292
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 293
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 294
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 295
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 296
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 297
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 298
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 299
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 300
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 301
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 302
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 303
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 304
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 305
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 306
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 307
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 308
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 309
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 310
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 311
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 312
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 313
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 314
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 315
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 316
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 317
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 318
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 319
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 320
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 321
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 322
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 323
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 324
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 325
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 326
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 327
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 328
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 329
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 330
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 331
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 332
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 333
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 334
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 335
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 336
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 337
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 338
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 339
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 340
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 341
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 342
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 343
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 344
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 345
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 346
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 347
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 348
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 349
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 350
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 351
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 352
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 353
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 354
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 355
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 356
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 357
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002524"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002524"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 358
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002a6c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000c84"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 359
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000c84"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f1f0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 360
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002a6c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002a6c"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 361
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001f0c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 362
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001e80"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 363
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001ef4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 364
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001efc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 365
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001f70"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 366
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001f84"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 367
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001f9c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 368
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001f98"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 369
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001eac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 370
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001e54"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 371
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001c90"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Burn"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 372
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001fb4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Burn"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 373
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001ed8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 374
          },
          {
            "timestamp": "2026-05-29 09:23:57,149",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001edc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 375
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001db0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 376
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001ebc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 377
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000c84"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001f68"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 378
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001f68"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f1f0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 379
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000c84"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000c84"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 380
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002a74"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000c84"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 381
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000c84"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f1f0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 382
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002a74"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002a74"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 383
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002a74"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\Public\\Desktop"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 384
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001f5c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\Public\\Desktop"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 385
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000ef8"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001fb8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 386
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001fb8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f1f0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 387
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000ef8"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000ef8"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 388
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000ef8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\Desktop"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 389
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001fa8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\Desktop"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 390
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002a64"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001f50"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 391
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001f50"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f250"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 392
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002a64"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002a64"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 393
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002a64"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001124"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 394
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001124"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f1f0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 395
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002a64"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002a64"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 396
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00001794"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002a64"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 397
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002a64"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f1f0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 398
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00001794"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001794"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 399
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002ac0"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001794"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 400
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001794"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f1f0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 401
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002ac0"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002ac0"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 402
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00001f5c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002ac0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 403
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002ac0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f1f0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 404
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00001f5c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001f5c"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 405
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00001f68"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001f5c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 406
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001f5c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f1f0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 407
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 408
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 409
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 410
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 411
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 412
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 413
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 414
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 415
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 416
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 417
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 418
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 419
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 420
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 421
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 422
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 423
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 424
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 425
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 426
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 427
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 428
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 429
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 430
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 431
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 432
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 433
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 434
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 435
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 436
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 437
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 438
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 439
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 440
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 441
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 442
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 443
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 444
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 445
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 446
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 447
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 448
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 449
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 450
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 451
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 452
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 453
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 454
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 455
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 456
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 457
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 458
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 459
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 460
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 461
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 462
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 463
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 464
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 465
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 466
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 467
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 468
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "289AF617-1CC3-42A6-926C-E6A863F0E3BA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 469
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 470
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "35786D3C-B075-49B9-88DD-029876E11C01"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 471
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 472
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "289AF617-1CC3-42A6-926C-E6A863F0E3BA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 473
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 474
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "35786D3C-B075-49B9-88DD-029876E11C01"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 475
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 476
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 477
          },
          {
            "timestamp": "2026-05-29 09:23:57,165",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 478
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 479
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 480
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 481
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 482
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 483
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 484
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 485
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 486
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 487
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 488
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 489
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 490
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 491
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 492
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 493
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 494
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 495
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 496
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 497
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 498
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 499
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 500
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 501
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 502
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 503
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 504
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 505
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 506
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 507
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 508
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 509
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 510
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 511
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 512
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 513
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 514
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 515
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 516
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 517
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 518
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 519
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 520
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 521
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 522
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 523
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 524
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 525
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 526
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 527
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 528
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 529
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 530
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 531
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 532
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 533
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 534
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 535
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 536
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 537
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 538
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 539
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 540
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 541
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 542
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 543
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 544
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 545
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 546
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 547
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 548
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 549
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 550
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 551
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 552
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 553
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 554
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 555
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 556
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 557
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 558
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 559
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 560
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 561
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 562
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 563
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 564
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 565
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 566
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 567
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00001f68"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001f68"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 568
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002a74"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001f68"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 569
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001f68"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f250"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 570
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002a74"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002a74"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 571
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002588"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002a74"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 572
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002a74"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f250"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 573
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002588"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002588"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 574
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002450"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002588"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 575
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002588"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f1f0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 576
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 577
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 578
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 579
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 580
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 581
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 582
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 583
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 584
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 585
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 586
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 587
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 588
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 589
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 590
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 591
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 592
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 593
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 594
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 595
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 596
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 597
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 598
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 599
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 600
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 601
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 602
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 603
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 604
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 605
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 606
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 607
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 608
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 609
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 610
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 611
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 612
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 613
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 614
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 615
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 616
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 617
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 618
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 619
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 620
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 621
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 622
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 623
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 624
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 625
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 626
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 627
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 628
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 629
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 630
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 631
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 632
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 633
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 634
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 635
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 636
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 637
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "289AF617-1CC3-42A6-926C-E6A863F0E3BA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 638
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 639
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "35786D3C-B075-49B9-88DD-029876E11C01"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 640
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 641
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "289AF617-1CC3-42A6-926C-E6A863F0E3BA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 642
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 643
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "35786D3C-B075-49B9-88DD-029876E11C01"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 644
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 645
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 646
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 647
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 648
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 649
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 650
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 651
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 652
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 653
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 654
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 655
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 656
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 657
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 658
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 659
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 660
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 661
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 662
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 663
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 664
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 665
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 666
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 667
          },
          {
            "timestamp": "2026-05-29 09:23:57,180",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 668
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 669
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 670
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 671
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 672
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 673
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 674
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 675
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 676
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 677
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 678
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 679
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 680
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 681
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 682
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 683
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 684
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 685
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 686
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 687
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 688
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 689
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 690
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 691
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 692
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 693
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 694
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 695
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 696
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 697
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 698
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 699
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 700
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 701
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 702
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 703
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 704
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 705
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 706
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 707
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 708
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 709
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 710
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 711
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 712
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 713
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 714
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 715
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 716
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 717
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 718
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 719
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 720
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 721
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 722
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4cd912f2",
            "parentcaller": "0x7fff4cd9109a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 723
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4cd8c333",
            "parentcaller": "0x7fff4cd89609",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 724
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 725
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 726
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 727
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 728
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 729
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 730
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 731
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b075ed6",
            "parentcaller": "0x7fff4b074fe8",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 732
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4cd8c375",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "116F8D13-101E-4FA5-84D4-FF8279381935"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 733
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff4b0760d1",
            "parentcaller": "0x7fff4b076111",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000415",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "0FC988D4-C935-4B97-A973-46282EA175C8"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 734
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d56b2",
            "parentcaller": "0x7fff558258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff58be0000"
              }
            ],
            "repeated": 0,
            "id": 735
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff55825882",
            "parentcaller": "0x7fff55824474",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "04731B67-D933-450A-90E6-4ACD2E9408FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 736
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002450"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002450"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 737
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002588"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002450"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 738
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002450"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f1f0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 739
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002588"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002588"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 740
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002588"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 741
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002a18"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 742
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002ab0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 743
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000227c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 744
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002150"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 745
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001abc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 746
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002ac0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 747
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002a64"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 748
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001c8c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 749
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001838"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 750
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Burn"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 751
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000d8c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Burn"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 752
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000d84"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 753
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001e74"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 754
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001168"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 755
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000eac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 756
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002a74"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000018f0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 757
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000018f0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f1f0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 758
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002a74"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002a74"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 759
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000c84"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002a74"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 760
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002a74"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f1f0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 761
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000c84"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000c84"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 762
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000c84"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\Public\\Desktop"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 763
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001054"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\Public\\Desktop"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 764
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00001f84"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000018e4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 765
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000018e4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f1f0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 766
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00001f84"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001f84"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 767
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001f84"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\Desktop"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 768
          },
          {
            "timestamp": "2026-05-29 09:23:57,196",
            "thread_id": "4720",
            "caller": "0x7fff577d6579",
            "parentcaller": "0x7fff577d5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001830"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\Desktop"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 769
          },
          {
            "timestamp": "2026-05-29 09:23:57,212",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00001f8c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002560"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 770
          },
          {
            "timestamp": "2026-05-29 09:23:57,212",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002560"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f250"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 771
          },
          {
            "timestamp": "2026-05-29 09:23:57,212",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00001f8c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001f8c"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 772
          },
          {
            "timestamp": "2026-05-29 09:23:57,227",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00001f8c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001f70"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 773
          },
          {
            "timestamp": "2026-05-29 09:23:57,227",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001f70"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f1f0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 774
          },
          {
            "timestamp": "2026-05-29 09:23:57,227",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00001f8c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001f8c"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 775
          },
          {
            "timestamp": "2026-05-29 09:23:57,227",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002560"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001f8c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 776
          },
          {
            "timestamp": "2026-05-29 09:23:57,227",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001f8c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f250"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 777
          },
          {
            "timestamp": "2026-05-29 09:23:57,227",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002560"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002560"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 778
          },
          {
            "timestamp": "2026-05-29 09:23:57,227",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002afc"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002560"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 779
          },
          {
            "timestamp": "2026-05-29 09:23:57,227",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002560"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f1f0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 780
          },
          {
            "timestamp": "2026-05-29 09:23:57,227",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002afc"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002afc"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 781
          },
          {
            "timestamp": "2026-05-29 09:23:57,227",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002afc"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002464"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 782
          },
          {
            "timestamp": "2026-05-29 09:23:57,227",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002464"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f1f0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 783
          },
          {
            "timestamp": "2026-05-29 09:23:57,227",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002afc"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002afc"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 784
          },
          {
            "timestamp": "2026-05-29 09:23:57,227",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002afc"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002578"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 785
          },
          {
            "timestamp": "2026-05-29 09:23:57,227",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002578"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f250"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 786
          },
          {
            "timestamp": "2026-05-29 09:23:57,227",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002afc"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002afc"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 787
          },
          {
            "timestamp": "2026-05-29 09:23:57,227",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002464"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002afc"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 788
          },
          {
            "timestamp": "2026-05-29 09:23:57,227",
            "thread_id": "4720",
            "caller": "0x7fff5780c386",
            "parentcaller": "0x7fff5780c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002afc"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0779f1f0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 789
          },
          {
            "timestamp": "2026-05-29 09:23:57,227",
            "thread_id": "4720",
            "caller": "0x7fff57806f4c",
            "parentcaller": "0x7fff5807f034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002464"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002464"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 790
          }
        ],
        "threads": [
          "4576",
          "4720"
        ],
        "environ": {
          "UserName": "admin",
          "ComputerName": "DESKTOP-74SUV8W",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\",
          "CommandLine": "C:\\Windows\\Explorer.EXE",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "b34c-3674",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff79bc10000",
          "MainExeSize": "0x00546000",
          "Bitness": "64-bit"
        },
        "file_activities": {
          "read_files": [],
          "write_files": [],
          "delete_files": []
        }
      },
      {
        "process_id": 8412,
        "process_name": "msedge.exe",
        "parent_id": 4484,
        "module_path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
        "first_seen": "2026-05-29 09:24:06,054",
        "calls": [
          {
            "timestamp": "2026-05-29 09:24:06,148",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\bcryptprimitives"
              },
              {
                "name": "DllBase",
                "value": "0x7fff57ef0000"
              }
            ],
            "repeated": 0,
            "id": 0
          },
          {
            "timestamp": "2026-05-29 09:24:06,164",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\version"
              },
              {
                "name": "DllBase",
                "value": "0x7fff43500000"
              }
            ],
            "repeated": 0,
            "id": 1
          },
          {
            "timestamp": "2026-05-29 09:24:06,164",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\shcore"
              },
              {
                "name": "DllBase",
                "value": "0x7fff58070000"
              }
            ],
            "repeated": 0,
            "id": 2
          },
          {
            "timestamp": "2026-05-29 09:24:06,164",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\shcore"
              },
              {
                "name": "DllBase",
                "value": "0x7fff58070000"
              }
            ],
            "repeated": 0,
            "id": 3
          },
          {
            "timestamp": "2026-05-29 09:24:06,164",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\Wldp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff56fa0000"
              }
            ],
            "repeated": 0,
            "id": 4
          },
          {
            "timestamp": "2026-05-29 09:24:06,164",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\windows.storage"
              },
              {
                "name": "DllBase",
                "value": "0x7fff55710000"
              }
            ],
            "repeated": 0,
            "id": 5
          },
          {
            "timestamp": "2026-05-29 09:24:06,164",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\SHCORE"
              },
              {
                "name": "DllBase",
                "value": "0x7fff58070000"
              }
            ],
            "repeated": 0,
            "id": 6
          },
          {
            "timestamp": "2026-05-29 09:24:06,164",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\ntmarta"
              },
              {
                "name": "DllBase",
                "value": "0x7fff56770000"
              }
            ],
            "repeated": 0,
            "id": 7
          },
          {
            "timestamp": "2026-05-29 09:24:06,304",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\WINMM"
              },
              {
                "name": "DllBase",
                "value": "0x7fff453c0000"
              }
            ],
            "repeated": 0,
            "id": 8
          },
          {
            "timestamp": "2026-05-29 09:24:06,320",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge"
              },
              {
                "name": "DllBase",
                "value": "0x7ffefe540000"
              }
            ],
            "repeated": 0,
            "id": 9
          },
          {
            "timestamp": "2026-05-29 09:24:06,320",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\KBDUS"
              },
              {
                "name": "DllBase",
                "value": "0x7fff45010000"
              }
            ],
            "repeated": 0,
            "id": 10
          },
          {
            "timestamp": "2026-05-29 09:24:06,320",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\KBDUS"
              },
              {
                "name": "DllBase",
                "value": "0x7fff45010000"
              }
            ],
            "repeated": 0,
            "id": 11
          },
          {
            "timestamp": "2026-05-29 09:24:06,336",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\uxtheme"
              },
              {
                "name": "DllBase",
                "value": "0x7fff54fc0000"
              }
            ],
            "repeated": 0,
            "id": 12
          },
          {
            "timestamp": "2026-05-29 09:24:06,336",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\kernel.appcore"
              },
              {
                "name": "DllBase",
                "value": "0x7fff55510000"
              }
            ],
            "repeated": 0,
            "id": 13
          },
          {
            "timestamp": "2026-05-29 09:24:06,336",
            "thread_id": "4460",
            "caller": "0x7fff577fc5f2",
            "parentcaller": "0x7fff577f89f3",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000370"
              },
              {
                "name": "ThreadHandle",
                "value": "0x0000036c"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=crashpad-handler \"--user-data-dir=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=148.0.7778.180 \"--annotation=exe=C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=148.0.3967.83 --initial-client-data=0x348,0x34c,0x350,0x344,0x358,0x7fff16e25d58,0x7fff16e25d64,0x7fff16e25d70"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "408"
              }
            ],
            "repeated": 0,
            "id": 14
          },
          {
            "timestamp": "2026-05-29 09:24:06,336",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\clbcatq"
              },
              {
                "name": "DllBase",
                "value": "0x7fff58b30000"
              }
            ],
            "repeated": 0,
            "id": 15
          },
          {
            "timestamp": "2026-05-29 09:24:06,351",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings"
              },
              {
                "name": "DllBase",
                "value": "0x7fff186f0000"
              }
            ],
            "repeated": 0,
            "id": 16
          },
          {
            "timestamp": "2026-05-29 09:24:06,351",
            "thread_id": "4460",
            "caller": "0x7fff577f89f3",
            "parentcaller": "0x7fff599d7d70",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=crashpad-handler \"--user-data-dir=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=148.0.7778.180 \"--annotation=exe=C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=148.0.3967.83 --initial-client-data=0x348,0x34c,0x350,0x344,0x358,0x7fff16e25d58,0x7fff16e25d64,0x7fff16e25d70"
              },
              {
                "name": "CreationFlags",
                "value": "0x00080000",
                "pretty_value": "EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "408"
              },
              {
                "name": "ThreadId",
                "value": "8892"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00000370"
              },
              {
                "name": "ThreadHandle",
                "value": "0x0000036c"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 17
          },
          {
            "timestamp": "2026-05-29 09:24:06,351",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x7fff566c0000"
              }
            ],
            "repeated": 0,
            "id": 18
          },
          {
            "timestamp": "2026-05-29 09:24:06,351",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\policymanager"
              },
              {
                "name": "DllBase",
                "value": "0x7fff522d0000"
              }
            ],
            "repeated": 0,
            "id": 19
          },
          {
            "timestamp": "2026-05-29 09:24:06,351",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\policymanager"
              },
              {
                "name": "DllBase",
                "value": "0x7fff522d0000"
              }
            ],
            "repeated": 0,
            "id": 20
          },
          {
            "timestamp": "2026-05-29 09:24:06,351",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x7fff566c0000"
              }
            ],
            "repeated": 0,
            "id": 21
          },
          {
            "timestamp": "2026-05-29 09:24:06,351",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\USERENV"
              },
              {
                "name": "DllBase",
                "value": "0x7fff57520000"
              }
            ],
            "repeated": 0,
            "id": 22
          },
          {
            "timestamp": "2026-05-29 09:24:06,351",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\gpapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff55ec0000"
              }
            ],
            "repeated": 0,
            "id": 23
          },
          {
            "timestamp": "2026-05-29 09:24:06,351",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wkscli"
              },
              {
                "name": "DllBase",
                "value": "0x7fff56750000"
              }
            ],
            "repeated": 0,
            "id": 24
          },
          {
            "timestamp": "2026-05-29 09:24:06,351",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\netutils"
              },
              {
                "name": "DllBase",
                "value": "0x7fff56a30000"
              }
            ],
            "repeated": 0,
            "id": 25
          },
          {
            "timestamp": "2026-05-29 09:24:06,351",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x7fff566c0000"
              }
            ],
            "repeated": 0,
            "id": 26
          },
          {
            "timestamp": "2026-05-29 09:24:06,351",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\MDMRegistration"
              },
              {
                "name": "DllBase",
                "value": "0x7fff16930000"
              }
            ],
            "repeated": 0,
            "id": 27
          },
          {
            "timestamp": "2026-05-29 09:24:06,351",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\powrprof"
              },
              {
                "name": "DllBase",
                "value": "0x7fff57490000"
              }
            ],
            "repeated": 0,
            "id": 28
          },
          {
            "timestamp": "2026-05-29 09:24:06,351",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\CRYPTSP"
              },
              {
                "name": "DllBase",
                "value": "0x7fff56ef0000"
              }
            ],
            "repeated": 0,
            "id": 29
          },
          {
            "timestamp": "2026-05-29 09:24:06,351",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\ncrypt"
              },
              {
                "name": "DllBase",
                "value": "0x7fff57010000"
              }
            ],
            "repeated": 0,
            "id": 30
          },
          {
            "timestamp": "2026-05-29 09:24:06,351",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\imagehlp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff59ef0000"
              }
            ],
            "repeated": 0,
            "id": 31
          },
          {
            "timestamp": "2026-05-29 09:24:06,367",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\tbs"
              },
              {
                "name": "DllBase",
                "value": "0x7fff4fa10000"
              }
            ],
            "repeated": 0,
            "id": 32
          },
          {
            "timestamp": "2026-05-29 09:24:06,367",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DMCmnUtils"
              },
              {
                "name": "DllBase",
                "value": "0x7fff15300000"
              }
            ],
            "repeated": 0,
            "id": 33
          },
          {
            "timestamp": "2026-05-29 09:24:06,367",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\omadmapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff3f6a0000"
              }
            ],
            "repeated": 0,
            "id": 34
          },
          {
            "timestamp": "2026-05-29 09:24:06,367",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\UMPDC"
              },
              {
                "name": "DllBase",
                "value": "0x7fff57470000"
              }
            ],
            "repeated": 0,
            "id": 35
          },
          {
            "timestamp": "2026-05-29 09:24:06,367",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\NTASN1"
              },
              {
                "name": "DllBase",
                "value": "0x7fff56fd0000"
              }
            ],
            "repeated": 0,
            "id": 36
          },
          {
            "timestamp": "2026-05-29 09:24:06,367",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\MDMRegistration"
              },
              {
                "name": "DllBase",
                "value": "0x7fff16930000"
              }
            ],
            "repeated": 0,
            "id": 37
          },
          {
            "timestamp": "2026-05-29 09:24:06,367",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\omadmapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff3f6a0000"
              }
            ],
            "repeated": 0,
            "id": 38
          },
          {
            "timestamp": "2026-05-29 09:24:06,367",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x7fff566c0000"
              }
            ],
            "repeated": 0,
            "id": 39
          },
          {
            "timestamp": "2026-05-29 09:24:06,367",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\powrprof"
              },
              {
                "name": "DllBase",
                "value": "0x7fff57490000"
              }
            ],
            "repeated": 0,
            "id": 40
          },
          {
            "timestamp": "2026-05-29 09:24:06,367",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\UMPDC"
              },
              {
                "name": "DllBase",
                "value": "0x7fff57470000"
              }
            ],
            "repeated": 0,
            "id": 41
          },
          {
            "timestamp": "2026-05-29 09:24:06,367",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DMCmnUtils"
              },
              {
                "name": "DllBase",
                "value": "0x7fff15300000"
              }
            ],
            "repeated": 0,
            "id": 42
          },
          {
            "timestamp": "2026-05-29 09:24:06,367",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\CRYPTSP"
              },
              {
                "name": "DllBase",
                "value": "0x7fff56ef0000"
              }
            ],
            "repeated": 0,
            "id": 43
          },
          {
            "timestamp": "2026-05-29 09:24:06,367",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\ncrypt"
              },
              {
                "name": "DllBase",
                "value": "0x7fff57010000"
              }
            ],
            "repeated": 0,
            "id": 44
          },
          {
            "timestamp": "2026-05-29 09:24:06,367",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\NTASN1"
              },
              {
                "name": "DllBase",
                "value": "0x7fff56fd0000"
              }
            ],
            "repeated": 0,
            "id": 45
          },
          {
            "timestamp": "2026-05-29 09:24:06,367",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\tbs"
              },
              {
                "name": "DllBase",
                "value": "0x7fff4fa10000"
              }
            ],
            "repeated": 0,
            "id": 46
          },
          {
            "timestamp": "2026-05-29 09:24:06,367",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\imagehlp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff59ef0000"
              }
            ],
            "repeated": 0,
            "id": 47
          },
          {
            "timestamp": "2026-05-29 09:24:06,367",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\netapi32"
              },
              {
                "name": "DllBase",
                "value": "0x7fff43550000"
              }
            ],
            "repeated": 0,
            "id": 48
          },
          {
            "timestamp": "2026-05-29 09:24:06,367",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x7fff566c0000"
              }
            ],
            "repeated": 0,
            "id": 49
          },
          {
            "timestamp": "2026-05-29 09:24:06,367",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\cryptsp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff56ef0000"
              }
            ],
            "repeated": 0,
            "id": 50
          },
          {
            "timestamp": "2026-05-29 09:24:06,367",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DSREG"
              },
              {
                "name": "DllBase",
                "value": "0x7fff52f20000"
              }
            ],
            "repeated": 0,
            "id": 51
          },
          {
            "timestamp": "2026-05-29 09:24:06,367",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\profapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff57560000"
              }
            ],
            "repeated": 0,
            "id": 52
          },
          {
            "timestamp": "2026-05-29 09:24:06,367",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\netapi32"
              },
              {
                "name": "DllBase",
                "value": "0x7fff43550000"
              }
            ],
            "repeated": 0,
            "id": 53
          },
          {
            "timestamp": "2026-05-29 09:24:06,367",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DSREG"
              },
              {
                "name": "DllBase",
                "value": "0x7fff52f20000"
              }
            ],
            "repeated": 0,
            "id": 54
          },
          {
            "timestamp": "2026-05-29 09:24:06,367",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x7fff566c0000"
              }
            ],
            "repeated": 0,
            "id": 55
          },
          {
            "timestamp": "2026-05-29 09:24:06,367",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\cryptsp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff56ef0000"
              }
            ],
            "repeated": 0,
            "id": 56
          },
          {
            "timestamp": "2026-05-29 09:24:06,398",
            "thread_id": "8276",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\AssignedAccessRuntime"
              },
              {
                "name": "DllBase",
                "value": "0x7fff4cfa0000"
              }
            ],
            "repeated": 0,
            "id": 57
          },
          {
            "timestamp": "2026-05-29 09:24:06,398",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\MSCTF"
              },
              {
                "name": "DllBase",
                "value": "0x7fff58380000"
              }
            ],
            "repeated": 0,
            "id": 58
          },
          {
            "timestamp": "2026-05-29 09:24:06,398",
            "thread_id": "8276",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\SystemSettings.DataModel"
              },
              {
                "name": "DllBase",
                "value": "0x7fff4d3d0000"
              }
            ],
            "repeated": 0,
            "id": 59
          },
          {
            "timestamp": "2026-05-29 09:24:06,398",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\powrprof"
              },
              {
                "name": "DllBase",
                "value": "0x7fff57490000"
              }
            ],
            "repeated": 0,
            "id": 60
          },
          {
            "timestamp": "2026-05-29 09:24:06,398",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\UMPDC"
              },
              {
                "name": "DllBase",
                "value": "0x7fff57470000"
              }
            ],
            "repeated": 0,
            "id": 61
          },
          {
            "timestamp": "2026-05-29 09:24:06,398",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DWrite"
              },
              {
                "name": "DllBase",
                "value": "0x7fff49a90000"
              }
            ],
            "repeated": 0,
            "id": 62
          },
          {
            "timestamp": "2026-05-29 09:24:06,398",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\\COMCTL32"
              },
              {
                "name": "DllBase",
                "value": "0x7fff44d50000"
              }
            ],
            "repeated": 0,
            "id": 63
          },
          {
            "timestamp": "2026-05-29 09:24:06,414",
            "thread_id": "4856",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub"
              },
              {
                "name": "DllBase",
                "value": "0x7fff50870000"
              }
            ],
            "repeated": 0,
            "id": 64
          },
          {
            "timestamp": "2026-05-29 09:24:06,414",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DPAPI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff57350000"
              }
            ],
            "repeated": 0,
            "id": 65
          },
          {
            "timestamp": "2026-05-29 09:24:06,414",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\IPHLPAPI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff569f0000"
              }
            ],
            "repeated": 0,
            "id": 66
          },
          {
            "timestamp": "2026-05-29 09:24:06,414",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\NLAapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff52960000"
              }
            ],
            "repeated": 0,
            "id": 67
          },
          {
            "timestamp": "2026-05-29 09:24:06,414",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\NSI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff58b20000"
              }
            ],
            "repeated": 0,
            "id": 68
          },
          {
            "timestamp": "2026-05-29 09:24:06,414",
            "thread_id": "8920",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\CFGMGR32"
              },
              {
                "name": "DllBase",
                "value": "0x7fff57750000"
              }
            ],
            "repeated": 0,
            "id": 69
          },
          {
            "timestamp": "2026-05-29 09:24:06,414",
            "thread_id": "5992",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\StructuredQuery"
              },
              {
                "name": "DllBase",
                "value": "0x7fff4b070000"
              }
            ],
            "repeated": 0,
            "id": 70
          },
          {
            "timestamp": "2026-05-29 09:24:06,414",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\dhcpcsvc6"
              },
              {
                "name": "DllBase",
                "value": "0x7fff515c0000"
              }
            ],
            "repeated": 0,
            "id": 71
          },
          {
            "timestamp": "2026-05-29 09:24:06,429",
            "thread_id": "5992",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\PROPSYS"
              },
              {
                "name": "DllBase",
                "value": "0x7fff52860000"
              }
            ],
            "repeated": 0,
            "id": 72
          },
          {
            "timestamp": "2026-05-29 09:24:06,429",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\dhcpcsvc"
              },
              {
                "name": "DllBase",
                "value": "0x7fff515a0000"
              }
            ],
            "repeated": 0,
            "id": 73
          },
          {
            "timestamp": "2026-05-29 09:24:06,429",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DNSAPI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff56a40000"
              }
            ],
            "repeated": 0,
            "id": 74
          },
          {
            "timestamp": "2026-05-29 09:24:06,429",
            "thread_id": "7928",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.StateRepositoryPS"
              },
              {
                "name": "DllBase",
                "value": "0x7fff4cbf0000"
              }
            ],
            "repeated": 0,
            "id": 75
          },
          {
            "timestamp": "2026-05-29 09:24:06,429",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\CoreMessaging"
              },
              {
                "name": "DllBase",
                "value": "0x7fff54850000"
              }
            ],
            "repeated": 0,
            "id": 76
          },
          {
            "timestamp": "2026-05-29 09:24:06,445",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wintypes"
              },
              {
                "name": "DllBase",
                "value": "0x7fff52dc0000"
              }
            ],
            "repeated": 0,
            "id": 77
          },
          {
            "timestamp": "2026-05-29 09:24:06,445",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\CoreUIComponents"
              },
              {
                "name": "DllBase",
                "value": "0x7fff54170000"
              }
            ],
            "repeated": 0,
            "id": 78
          },
          {
            "timestamp": "2026-05-29 09:24:06,445",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\textinputframework"
              },
              {
                "name": "DllBase",
                "value": "0x7fff4b680000"
              }
            ],
            "repeated": 0,
            "id": 79
          },
          {
            "timestamp": "2026-05-29 09:24:06,445",
            "thread_id": "5992",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\Windows.Storage.Search"
              },
              {
                "name": "DllBase",
                "value": "0x7fff4cd70000"
              }
            ],
            "repeated": 0,
            "id": 80
          },
          {
            "timestamp": "2026-05-29 09:24:06,445",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\twinapi.appcore"
              },
              {
                "name": "DllBase",
                "value": "0x7fff517c0000"
              }
            ],
            "repeated": 0,
            "id": 81
          },
          {
            "timestamp": "2026-05-29 09:24:06,445",
            "thread_id": "7928",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\mssprxy"
              },
              {
                "name": "DllBase",
                "value": "0x7fff4cd40000"
              }
            ],
            "repeated": 0,
            "id": 82
          },
          {
            "timestamp": "2026-05-29 09:24:06,445",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\twinapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff45580000"
              }
            ],
            "repeated": 0,
            "id": 83
          },
          {
            "timestamp": "2026-05-29 09:24:06,445",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wevtapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff52420000"
              }
            ],
            "repeated": 0,
            "id": 84
          },
          {
            "timestamp": "2026-05-29 09:24:06,445",
            "thread_id": "4856",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\edputil"
              },
              {
                "name": "DllBase",
                "value": "0x7fff47ab0000"
              }
            ],
            "repeated": 0,
            "id": 85
          },
          {
            "timestamp": "2026-05-29 09:24:06,461",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\WindowManagementAPI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff51a60000"
              }
            ],
            "repeated": 0,
            "id": 86
          },
          {
            "timestamp": "2026-05-29 09:24:06,461",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\InputHost"
              },
              {
                "name": "DllBase",
                "value": "0x7fff4af10000"
              }
            ],
            "repeated": 0,
            "id": 87
          },
          {
            "timestamp": "2026-05-29 09:24:06,461",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.UI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff4bfb0000"
              }
            ],
            "repeated": 0,
            "id": 88
          },
          {
            "timestamp": "2026-05-29 09:24:06,461",
            "thread_id": "1688",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\WTSAPI32"
              },
              {
                "name": "DllBase",
                "value": "0x7fff52b00000"
              }
            ],
            "repeated": 0,
            "id": 89
          },
          {
            "timestamp": "2026-05-29 09:24:06,461",
            "thread_id": "1688",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\WINSTA"
              },
              {
                "name": "DllBase",
                "value": "0x7fff57360000"
              }
            ],
            "repeated": 0,
            "id": 90
          },
          {
            "timestamp": "2026-05-29 09:24:06,461",
            "thread_id": "8276",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\iertutil"
              },
              {
                "name": "DllBase",
                "value": "0x7fff4d6a0000"
              }
            ],
            "repeated": 0,
            "id": 91
          },
          {
            "timestamp": "2026-05-29 09:24:06,461",
            "thread_id": "8276",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.Web"
              },
              {
                "name": "DllBase",
                "value": "0x7fff47980000"
              }
            ],
            "repeated": 0,
            "id": 92
          },
          {
            "timestamp": "2026-05-29 09:24:06,461",
            "thread_id": "5764",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\ColorAdapterClient"
              },
              {
                "name": "DllBase",
                "value": "0x7fff515e0000"
              }
            ],
            "repeated": 0,
            "id": 93
          },
          {
            "timestamp": "2026-05-29 09:24:06,476",
            "thread_id": "5764",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\mscms"
              },
              {
                "name": "DllBase",
                "value": "0x7fff51600000"
              }
            ],
            "repeated": 0,
            "id": 94
          },
          {
            "timestamp": "2026-05-29 09:24:06,476",
            "thread_id": "8276",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\WINHTTP"
              },
              {
                "name": "DllBase",
                "value": "0x7fff52560000"
              }
            ],
            "repeated": 0,
            "id": 95
          },
          {
            "timestamp": "2026-05-29 09:24:06,492",
            "thread_id": "8276",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\oneauth"
              },
              {
                "name": "DllBase",
                "value": "0x7fff163d0000"
              }
            ],
            "repeated": 0,
            "id": 96
          },
          {
            "timestamp": "2026-05-29 09:24:06,492",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.UI.Immersive"
              },
              {
                "name": "DllBase",
                "value": "0x7fff49d10000"
              }
            ],
            "repeated": 0,
            "id": 97
          },
          {
            "timestamp": "2026-05-29 09:24:06,492",
            "thread_id": "3276",
            "caller": "0x7fff577fc5f2",
            "parentcaller": "0x7fff577f9666",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000a20"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000a1c"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2408,i,1694955159890818981,7047667544628051604,524288 --field-trial-handle=2292,i,10729465624520103307,2062822685409760543,262144 --variations-seed-version --pseudonymization-salt-handle=2296,i,15553667181084516343,5252397608772664425,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2580 /prefetch:3"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "3544"
              }
            ],
            "repeated": 0,
            "id": 98
          },
          {
            "timestamp": "2026-05-29 09:24:06,492",
            "thread_id": "8276",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\Secur32"
              },
              {
                "name": "DllBase",
                "value": "0x7fff48330000"
              }
            ],
            "repeated": 0,
            "id": 99
          },
          {
            "timestamp": "2026-05-29 09:24:06,492",
            "thread_id": "3276",
            "caller": "0x7fff577f9666",
            "parentcaller": "0x7fff57fccec4",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": ""
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2408,i,1694955159890818981,7047667544628051604,524288 --field-trial-handle=2292,i,10729465624520103307,2062822685409760543,262144 --variations-seed-version --pseudonymization-salt-handle=2296,i,15553667181084516343,5252397608772664425,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2580 /prefetch:3"
              },
              {
                "name": "CreationFlags",
                "value": "0x00080000",
                "pretty_value": "EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "3544"
              },
              {
                "name": "ThreadId",
                "value": "8960"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00000a20"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000a1c"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 100
          },
          {
            "timestamp": "2026-05-29 09:24:06,492",
            "thread_id": "6084",
            "caller": "0x7ff7f5477d66",
            "parentcaller": "0x7ff7f54781c2",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000a1c"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000009e4"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2192,i,13829448100614764305,10446313316907860392,262144 --field-trial-handle=2292,i,10729465624520103307,2062822685409760543,262144 --variations-seed-version --pseudonymization-salt-handle=2296,i,15553667181084516343,5252397608772664425,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2300 /prefetch:2"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "6176"
              }
            ],
            "repeated": 0,
            "id": 101
          },
          {
            "timestamp": "2026-05-29 09:24:06,507",
            "thread_id": "6084",
            "caller": "0x7ff7f5477d66",
            "parentcaller": "0x7ff7f54781c2",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2192,i,13829448100614764305,10446313316907860392,262144 --field-trial-handle=2292,i,10729465624520103307,2062822685409760543,262144 --variations-seed-version --pseudonymization-salt-handle=2296,i,15553667181084516343,5252397608772664425,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2300 /prefetch:2"
              },
              {
                "name": "CreationFlags",
                "value": "0x0008040c",
                "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "6176"
              },
              {
                "name": "ThreadId",
                "value": "8948"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00000a1c"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000009e4"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 102
          },
          {
            "timestamp": "2026-05-29 09:24:06,507",
            "thread_id": "3688",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\sxs"
              },
              {
                "name": "DllBase",
                "value": "0x7fff573c0000"
              }
            ],
            "repeated": 0,
            "id": 103
          },
          {
            "timestamp": "2026-05-29 09:24:06,507",
            "thread_id": "8444",
            "caller": "0x7ff7f5477d66",
            "parentcaller": "0x7ff7f54781c2",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000bc8"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000bc4"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2764,i,17902477681311716978,351014672969593507,524288 --field-trial-handle=2292,i,10729465624520103307,2062822685409760543,262144 --variations-seed-version --pseudonymization-salt-handle=2296,i,15553667181084516343,5252397608772664425,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2776 /prefetch:8"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "3600"
              }
            ],
            "repeated": 0,
            "id": 104
          },
          {
            "timestamp": "2026-05-29 09:24:06,523",
            "thread_id": "9188",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\LINKINFO"
              },
              {
                "name": "DllBase",
                "value": "0x7fff43590000"
              }
            ],
            "repeated": 0,
            "id": 105
          },
          {
            "timestamp": "2026-05-29 09:24:06,539",
            "thread_id": "3688",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\usermgrcli"
              },
              {
                "name": "DllBase",
                "value": "0x7fff52490000"
              }
            ],
            "repeated": 0,
            "id": 106
          },
          {
            "timestamp": "2026-05-29 09:24:06,539",
            "thread_id": "3688",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.Internal.UI.Shell.WindowTabManager"
              },
              {
                "name": "DllBase",
                "value": "0x7fff409a0000"
              }
            ],
            "repeated": 0,
            "id": 107
          },
          {
            "timestamp": "2026-05-29 09:24:06,539",
            "thread_id": "8444",
            "caller": "0x7ff7f5477d66",
            "parentcaller": "0x7ff7f54781c2",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2764,i,17902477681311716978,351014672969593507,524288 --field-trial-handle=2292,i,10729465624520103307,2062822685409760543,262144 --variations-seed-version --pseudonymization-salt-handle=2296,i,15553667181084516343,5252397608772664425,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2776 /prefetch:8"
              },
              {
                "name": "CreationFlags",
                "value": "0x0008040c",
                "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "3600"
              },
              {
                "name": "ThreadId",
                "value": "1108"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00000bc8"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000bc4"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 108
          },
          {
            "timestamp": "2026-05-29 09:24:06,554",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\dxgi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff55ef0000"
              }
            ],
            "repeated": 0,
            "id": 109
          },
          {
            "timestamp": "2026-05-29 09:24:06,554",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\d3d11"
              },
              {
                "name": "DllBase",
                "value": "0x7fff53070000"
              }
            ],
            "repeated": 0,
            "id": 110
          },
          {
            "timestamp": "2026-05-29 09:24:06,554",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\dcomp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff538a0000"
              }
            ],
            "repeated": 0,
            "id": 111
          },
          {
            "timestamp": "2026-05-29 09:24:06,570",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\dataexchange"
              },
              {
                "name": "DllBase",
                "value": "0x7fff43630000"
              }
            ],
            "repeated": 0,
            "id": 112
          },
          {
            "timestamp": "2026-05-29 09:24:06,586",
            "thread_id": "8276",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.System.Profile.RetailInfo"
              },
              {
                "name": "DllBase",
                "value": "0x7fff3e230000"
              }
            ],
            "repeated": 0,
            "id": 113
          },
          {
            "timestamp": "2026-05-29 09:24:06,601",
            "thread_id": "3688",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\dwmapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff55220000"
              }
            ],
            "repeated": 0,
            "id": 114
          },
          {
            "timestamp": "2026-05-29 09:24:06,617",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\OLEACC"
              },
              {
                "name": "DllBase",
                "value": "0x7fff43990000"
              }
            ],
            "repeated": 0,
            "id": 115
          },
          {
            "timestamp": "2026-05-29 09:24:06,617",
            "thread_id": "6084",
            "caller": "0x7ff7f5477d66",
            "parentcaller": "0x7ff7f54781c2",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000ee8"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000eec"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780046460318496 --launch-time-ticks=186300813 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3608,i,14777499681252721830,2898587421990204859,2097152 --field-trial-handle=2292,i,10729465624520103307,2062822685409760543,262144 --variations-seed-version --pseudonymization-salt-handle=2296,i,15553667181084516343,5252397608772664425,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3640 /prefetch:1"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "6488"
              }
            ],
            "repeated": 0,
            "id": 116
          },
          {
            "timestamp": "2026-05-29 09:24:06,617",
            "thread_id": "5764",
            "caller": "0x7ff7f5477d66",
            "parentcaller": "0x7ff7f54781c2",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000f04"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000ef8"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780046460318496 --launch-time-ticks=186303281 --skip-read-main-dll --metrics-shmem-handle=3228,i,3090510312160170329,9534174169664371678,2097152 --field-trial-handle=2292,i,10729465624520103307,2062822685409760543,262144 --variations-seed-version --pseudonymization-salt-handle=2296,i,15553667181084516343,5252397608772664425,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2736 /prefetch:1"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "1380"
              }
            ],
            "repeated": 0,
            "id": 117
          },
          {
            "timestamp": "2026-05-29 09:24:06,617",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\directmanipulation"
              },
              {
                "name": "DllBase",
                "value": "0x7fff488b0000"
              }
            ],
            "repeated": 0,
            "id": 118
          },
          {
            "timestamp": "2026-05-29 09:24:06,617",
            "thread_id": "6084",
            "caller": "0x7ff7f5477d66",
            "parentcaller": "0x7ff7f54781c2",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780046460318496 --launch-time-ticks=186300813 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3608,i,14777499681252721830,2898587421990204859,2097152 --field-trial-handle=2292,i,10729465624520103307,2062822685409760543,262144 --variations-seed-version --pseudonymization-salt-handle=2296,i,15553667181084516343,5252397608772664425,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3640 /prefetch:1"
              },
              {
                "name": "CreationFlags",
                "value": "0x0008040c",
                "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "6488"
              },
              {
                "name": "ThreadId",
                "value": "6492"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00000ee8"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000eec"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 119
          },
          {
            "timestamp": "2026-05-29 09:24:06,617",
            "thread_id": "5764",
            "caller": "0x7ff7f5477d66",
            "parentcaller": "0x7ff7f54781c2",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780046460318496 --launch-time-ticks=186303281 --skip-read-main-dll --metrics-shmem-handle=3228,i,3090510312160170329,9534174169664371678,2097152 --field-trial-handle=2292,i,10729465624520103307,2062822685409760543,262144 --variations-seed-version --pseudonymization-salt-handle=2296,i,15553667181084516343,5252397608772664425,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2736 /prefetch:1"
              },
              {
                "name": "CreationFlags",
                "value": "0x0008040c",
                "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "1380"
              },
              {
                "name": "ThreadId",
                "value": "8772"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00000f04"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000ef8"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 120
          },
          {
            "timestamp": "2026-05-29 09:24:06,632",
            "thread_id": "3860",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.Security.Authentication.OnlineId"
              },
              {
                "name": "DllBase",
                "value": "0x7fff3ea70000"
              }
            ],
            "repeated": 0,
            "id": 121
          },
          {
            "timestamp": "2026-05-29 09:24:06,632",
            "thread_id": "3860",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\netapi32"
              },
              {
                "name": "DllBase",
                "value": "0x7fff43550000"
              }
            ],
            "repeated": 0,
            "id": 122
          },
          {
            "timestamp": "2026-05-29 09:24:06,679",
            "thread_id": "8452",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.Security.Authentication.Web.Core"
              },
              {
                "name": "DllBase",
                "value": "0x7fff456d0000"
              }
            ],
            "repeated": 0,
            "id": 123
          },
          {
            "timestamp": "2026-05-29 09:24:06,695",
            "thread_id": "9188",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\VCRUNTIME140"
              },
              {
                "name": "DllBase",
                "value": "0x7fff3f8a0000"
              }
            ],
            "repeated": 0,
            "id": 124
          },
          {
            "timestamp": "2026-05-29 09:24:06,695",
            "thread_id": "9188",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Domain Actions\\3.0.0.18\\domain_actions"
              },
              {
                "name": "DllBase",
                "value": "0x7fff42bf0000"
              }
            ],
            "repeated": 0,
            "id": 125
          },
          {
            "timestamp": "2026-05-29 09:24:06,726",
            "thread_id": "8444",
            "caller": "0x7ff7f5477d66",
            "parentcaller": "0x7ff7f54781c2",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Well Known Domains\\1.2.0.0\\well_known_domains"
              },
              {
                "name": "DllBase",
                "value": "0x7fff162a0000"
              }
            ],
            "repeated": 0,
            "id": 126
          },
          {
            "timestamp": "2026-05-29 09:24:06,742",
            "thread_id": "8920",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\OneCoreCommonProxyStub"
              },
              {
                "name": "DllBase",
                "value": "0x7fff48780000"
              }
            ],
            "repeated": 0,
            "id": 127
          },
          {
            "timestamp": "2026-05-29 09:24:06,742",
            "thread_id": "8276",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\MSASN1"
              },
              {
                "name": "DllBase",
                "value": "0x7fff57130000"
              }
            ],
            "repeated": 0,
            "id": 128
          },
          {
            "timestamp": "2026-05-29 09:24:06,742",
            "thread_id": "8920",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\vaultcli"
              },
              {
                "name": "DllBase",
                "value": "0x7fff3e730000"
              }
            ],
            "repeated": 0,
            "id": 129
          },
          {
            "timestamp": "2026-05-29 09:24:06,742",
            "thread_id": "8276",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\CRYPTSP"
              },
              {
                "name": "DllBase",
                "value": "0x7fff56ef0000"
              }
            ],
            "repeated": 0,
            "id": 130
          },
          {
            "timestamp": "2026-05-29 09:24:06,742",
            "thread_id": "8276",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\rsaenh"
              },
              {
                "name": "DllBase",
                "value": "0x7fff56630000"
              }
            ],
            "repeated": 0,
            "id": 131
          },
          {
            "timestamp": "2026-05-29 09:24:06,757",
            "thread_id": "1660",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\aadWamExtension"
              },
              {
                "name": "DllBase",
                "value": "0x7fff18730000"
              }
            ],
            "repeated": 0,
            "id": 132
          },
          {
            "timestamp": "2026-05-29 09:24:06,789",
            "thread_id": "3964",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\MicrosoftAccountWAMExtension"
              },
              {
                "name": "DllBase",
                "value": "0x7fff15540000"
              }
            ],
            "repeated": 0,
            "id": 133
          },
          {
            "timestamp": "2026-05-29 09:24:07,976",
            "thread_id": "8756",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\ShellCommonCommonProxyStub"
              },
              {
                "name": "DllBase",
                "value": "0x7fff3fd40000"
              }
            ],
            "repeated": 0,
            "id": 134
          },
          {
            "timestamp": "2026-05-29 09:24:08,367",
            "thread_id": "8276",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x7fff566c0000"
              }
            ],
            "repeated": 0,
            "id": 135
          },
          {
            "timestamp": "2026-05-29 09:24:08,367",
            "thread_id": "8276",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\policymanager"
              },
              {
                "name": "DllBase",
                "value": "0x7fff522d0000"
              }
            ],
            "repeated": 0,
            "id": 136
          },
          {
            "timestamp": "2026-05-29 09:24:08,367",
            "thread_id": "8276",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\policymanager"
              },
              {
                "name": "DllBase",
                "value": "0x7fff522d0000"
              }
            ],
            "repeated": 0,
            "id": 137
          },
          {
            "timestamp": "2026-05-29 09:24:08,367",
            "thread_id": "8276",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x7fff566c0000"
              }
            ],
            "repeated": 0,
            "id": 138
          },
          {
            "timestamp": "2026-05-29 09:24:08,976",
            "thread_id": "8276",
            "caller": "0x7ff7f5477d66",
            "parentcaller": "0x7ff7f54781c2",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000e58"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00001110"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1780046460318496 --launch-time-ticks=188647921 --skip-read-main-dll --metrics-shmem-handle=5152,i,4108351377575747650,13074092367968317022,2097152 --field-trial-handle=2292,i,10729465624520103307,2062822685409760543,262144 --variations-seed-version --pseudonymization-salt-handle=2296,i,15553667181084516343,5252397608772664425,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5392 /prefetch:1"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "9328"
              }
            ],
            "repeated": 0,
            "id": 139
          },
          {
            "timestamp": "2026-05-29 09:24:08,976",
            "thread_id": "8276",
            "caller": "0x7ff7f5477d66",
            "parentcaller": "0x7ff7f54781c2",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1780046460318496 --launch-time-ticks=188647921 --skip-read-main-dll --metrics-shmem-handle=5152,i,4108351377575747650,13074092367968317022,2097152 --field-trial-handle=2292,i,10729465624520103307,2062822685409760543,262144 --variations-seed-version --pseudonymization-salt-handle=2296,i,15553667181084516343,5252397608772664425,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5392 /prefetch:1"
              },
              {
                "name": "CreationFlags",
                "value": "0x0008040c",
                "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "9328"
              },
              {
                "name": "ThreadId",
                "value": "9332"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00000e58"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00001110"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 140
          },
          {
            "timestamp": "2026-05-29 09:24:08,976",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\RMCLIENT"
              },
              {
                "name": "DllBase",
                "value": "0x7fff55410000"
              }
            ],
            "repeated": 0,
            "id": 141
          },
          {
            "timestamp": "2026-05-29 09:24:08,992",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\XmlLite"
              },
              {
                "name": "DllBase",
                "value": "0x7fff523e0000"
              }
            ],
            "repeated": 0,
            "id": 142
          },
          {
            "timestamp": "2026-05-29 09:24:08,992",
            "thread_id": "8244",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\wpnapps"
              },
              {
                "name": "DllBase",
                "value": "0x7fff40fb0000"
              }
            ],
            "repeated": 0,
            "id": 143
          },
          {
            "timestamp": "2026-05-29 09:24:09,304",
            "thread_id": "8244",
            "caller": "0x7ff7f5420661",
            "parentcaller": "0x7ff7f541f1a0",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000de8"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000dd0"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "9432"
              }
            ],
            "repeated": 0,
            "id": 144
          }
        ],
        "threads": [
          "8244",
          "4460",
          "8276",
          "4856",
          "8920",
          "5992",
          "7928",
          "1688",
          "5764",
          "3276",
          "6084",
          "3688",
          "8444",
          "9188",
          "3860",
          "8452",
          "1660",
          "3964",
          "8756"
        ],
        "environ": {
          "UserName": "admin",
          "ComputerName": "DESKTOP-74SUV8W",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\",
          "CommandLine": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" \"g\"",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "b34c-3674",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff7f5380000",
          "MainExeSize": "0x00505000",
          "Bitness": "64-bit"
        },
        "file_activities": {
          "read_files": [],
          "write_files": [],
          "delete_files": []
        }
      }
    ],
    "anomaly": [],
    "processtree": [
      {
        "name": "explorer.exe",
        "pid": 4484,
        "parent_id": 4364,
        "module_path": "C:\\Windows\\explorer.exe",
        "children": [
          {
            "name": "msedge.exe",
            "pid": 8412,
            "parent_id": 4484,
            "module_path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
            "children": [],
            "threads": [
              "8244",
              "4460",
              "8276",
              "4856",
              "8920",
              "5992",
              "7928",
              "1688",
              "5764",
              "3276",
              "6084",
              "3688",
              "8444",
              "9188",
              "3860",
              "8452",
              "1660",
              "3964",
              "8756"
            ],
            "environ": {
              "UserName": "admin",
              "ComputerName": "DESKTOP-74SUV8W",
              "WindowsPath": "C:\\Windows",
              "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\",
              "CommandLine": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" \"g\"",
              "RegisteredOwner": "",
              "RegisteredOrganization": "",
              "ProductName": "",
              "SystemVolumeSerialNumber": "b34c-3674",
              "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
              "MachineGUID": "",
              "MainExeBase": "0x7ff7f5380000",
              "MainExeSize": "0x00505000",
              "Bitness": "64-bit"
            }
          }
        ],
        "threads": [
          "4576",
          "4720"
        ],
        "environ": {
          "UserName": "admin",
          "ComputerName": "DESKTOP-74SUV8W",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\",
          "CommandLine": "C:\\Windows\\Explorer.EXE",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "b34c-3674",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff79bc10000",
          "MainExeSize": "0x00546000",
          "Bitness": "64-bit"
        }
      }
    ],
    "summary": {
      "files": [
        "C:\\",
        "C:\\Users\\desktop.ini",
        "C:\\Users",
        "C:\\Users\\admin",
        "C:\\Users\\admin\\AppData",
        "C:\\Users\\admin\\AppData\\Roaming",
        "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\desktop.ini",
        "C:\\Users\\admin\\AppData\\Roaming\\Microsoft",
        "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows",
        "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned",
        "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs",
        "C:\\ProgramData\\Microsoft\\Windows\\Start Menu",
        "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs",
        "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu",
        "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Burn",
        "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts",
        "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts",
        "C:\\Users\\Public\\Desktop",
        "C:\\Users\\admin\\Desktop"
      ],
      "read_files": [],
      "write_files": [],
      "delete_files": [],
      "keys": [],
      "read_keys": [],
      "write_keys": [],
      "delete_keys": [],
      "executed_commands": [
        "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=crashpad-handler \"--user-data-dir=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=148.0.7778.180 \"--annotation=exe=C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=148.0.3967.83 --initial-client-data=0x348,0x34c,0x350,0x344,0x358,0x7fff16e25d58,0x7fff16e25d64,0x7fff16e25d70",
        "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2408,i,1694955159890818981,7047667544628051604,524288 --field-trial-handle=2292,i,10729465624520103307,2062822685409760543,262144 --variations-seed-version --pseudonymization-salt-handle=2296,i,15553667181084516343,5252397608772664425,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2580 /prefetch:3",
        "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2192,i,13829448100614764305,10446313316907860392,262144 --field-trial-handle=2292,i,10729465624520103307,2062822685409760543,262144 --variations-seed-version --pseudonymization-salt-handle=2296,i,15553667181084516343,5252397608772664425,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2300 /prefetch:2",
        "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2764,i,17902477681311716978,351014672969593507,524288 --field-trial-handle=2292,i,10729465624520103307,2062822685409760543,262144 --variations-seed-version --pseudonymization-salt-handle=2296,i,15553667181084516343,5252397608772664425,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2776 /prefetch:8",
        "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780046460318496 --launch-time-ticks=186300813 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3608,i,14777499681252721830,2898587421990204859,2097152 --field-trial-handle=2292,i,10729465624520103307,2062822685409760543,262144 --variations-seed-version --pseudonymization-salt-handle=2296,i,15553667181084516343,5252397608772664425,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3640 /prefetch:1",
        "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780046460318496 --launch-time-ticks=186303281 --skip-read-main-dll --metrics-shmem-handle=3228,i,3090510312160170329,9534174169664371678,2097152 --field-trial-handle=2292,i,10729465624520103307,2062822685409760543,262144 --variations-seed-version --pseudonymization-salt-handle=2296,i,15553667181084516343,5252397608772664425,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2736 /prefetch:1",
        "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1780046460318496 --launch-time-ticks=188647921 --skip-read-main-dll --metrics-shmem-handle=5152,i,4108351377575747650,13074092367968317022,2097152 --field-trial-handle=2292,i,10729465624520103307,2062822685409760543,262144 --variations-seed-version --pseudonymization-salt-handle=2296,i,15553667181084516343,5252397608772664425,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5392 /prefetch:1",
        "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window"
      ],
      "resolved_apis": [],
      "mutexes": [],
      "created_services": [],
      "started_services": []
    },
    "enhanced": [
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,087",
        "eid": 1,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,102",
        "eid": 2,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,102",
        "eid": 3,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,102",
        "eid": 4,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,102",
        "eid": 5,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,102",
        "eid": 6,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,102",
        "eid": 7,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,102",
        "eid": 8,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,102",
        "eid": 9,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,102",
        "eid": 10,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,102",
        "eid": 11,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,102",
        "eid": 12,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,102",
        "eid": 13,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,102",
        "eid": 14,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,102",
        "eid": 15,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,102",
        "eid": 16,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,133",
        "eid": 17,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,133",
        "eid": 18,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,133",
        "eid": 19,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,133",
        "eid": 20,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,133",
        "eid": 21,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,133",
        "eid": 22,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,133",
        "eid": 23,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,133",
        "eid": 24,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,133",
        "eid": 25,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,133",
        "eid": 26,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,133",
        "eid": 27,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,133",
        "eid": 28,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,133",
        "eid": 29,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,133",
        "eid": 30,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,133",
        "eid": 31,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,133",
        "eid": 32,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,133",
        "eid": 33,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,133",
        "eid": 34,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,133",
        "eid": 35,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,133",
        "eid": 36,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,133",
        "eid": 37,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,133",
        "eid": 38,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,133",
        "eid": 39,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,133",
        "eid": 40,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,133",
        "eid": 41,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,133",
        "eid": 42,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,133",
        "eid": 43,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,133",
        "eid": 44,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,149",
        "eid": 45,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,149",
        "eid": 46,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,149",
        "eid": 47,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,149",
        "eid": 48,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,149",
        "eid": 49,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,149",
        "eid": 50,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,149",
        "eid": 51,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,149",
        "eid": 52,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,149",
        "eid": 53,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,149",
        "eid": 54,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,149",
        "eid": 55,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,149",
        "eid": 56,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,149",
        "eid": 57,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,149",
        "eid": 58,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,149",
        "eid": 59,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,149",
        "eid": 60,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,149",
        "eid": 61,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,149",
        "eid": 62,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,149",
        "eid": 63,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,149",
        "eid": 64,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,165",
        "eid": 65,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,165",
        "eid": 66,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,165",
        "eid": 67,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,165",
        "eid": 68,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,165",
        "eid": 69,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,165",
        "eid": 70,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,165",
        "eid": 71,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,165",
        "eid": 72,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,165",
        "eid": 73,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,165",
        "eid": 74,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,165",
        "eid": 75,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,165",
        "eid": 76,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,165",
        "eid": 77,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,165",
        "eid": 78,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,165",
        "eid": 79,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,165",
        "eid": 80,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,165",
        "eid": 81,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 82,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 83,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 84,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 85,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 86,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 87,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 88,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 89,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 90,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 91,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 92,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 93,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 94,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 95,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 96,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 97,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 98,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 99,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 100,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 101,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 102,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 103,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 104,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 105,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 106,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 107,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 108,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 109,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 110,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 111,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 112,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 113,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 114,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,180",
        "eid": 115,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,196",
        "eid": 116,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,196",
        "eid": 117,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,196",
        "eid": 118,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,196",
        "eid": 119,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,196",
        "eid": 120,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,196",
        "eid": 121,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,196",
        "eid": 122,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,196",
        "eid": 123,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,196",
        "eid": 124,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,196",
        "eid": 125,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,196",
        "eid": 126,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,196",
        "eid": 127,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-29 09:23:57,196",
        "eid": 128,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff58be0000"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-29 09:24:06,351",
        "eid": 129,
        "data": {
          "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=crashpad-handler \"--user-data-dir=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=148.0.7778.180 \"--annotation=exe=C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=148.0.3967.83 --initial-client-data=0x348,0x34c,0x350,0x344,0x358,0x7fff16e25d58,0x7fff16e25d64,0x7fff16e25d70"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-29 09:24:06,492",
        "eid": 130,
        "data": {
          "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2408,i,1694955159890818981,7047667544628051604,524288 --field-trial-handle=2292,i,10729465624520103307,2062822685409760543,262144 --variations-seed-version --pseudonymization-salt-handle=2296,i,15553667181084516343,5252397608772664425,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2580 /prefetch:3"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-29 09:24:06,507",
        "eid": 131,
        "data": {
          "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2192,i,13829448100614764305,10446313316907860392,262144 --field-trial-handle=2292,i,10729465624520103307,2062822685409760543,262144 --variations-seed-version --pseudonymization-salt-handle=2296,i,15553667181084516343,5252397608772664425,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2300 /prefetch:2"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-29 09:24:06,539",
        "eid": 132,
        "data": {
          "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2764,i,17902477681311716978,351014672969593507,524288 --field-trial-handle=2292,i,10729465624520103307,2062822685409760543,262144 --variations-seed-version --pseudonymization-salt-handle=2296,i,15553667181084516343,5252397608772664425,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2776 /prefetch:8"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-29 09:24:06,617",
        "eid": 133,
        "data": {
          "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780046460318496 --launch-time-ticks=186300813 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3608,i,14777499681252721830,2898587421990204859,2097152 --field-trial-handle=2292,i,10729465624520103307,2062822685409760543,262144 --variations-seed-version --pseudonymization-salt-handle=2296,i,15553667181084516343,5252397608772664425,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3640 /prefetch:1"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-29 09:24:06,617",
        "eid": 134,
        "data": {
          "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780046460318496 --launch-time-ticks=186303281 --skip-read-main-dll --metrics-shmem-handle=3228,i,3090510312160170329,9534174169664371678,2097152 --field-trial-handle=2292,i,10729465624520103307,2062822685409760543,262144 --variations-seed-version --pseudonymization-salt-handle=2296,i,15553667181084516343,5252397608772664425,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2736 /prefetch:1"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-29 09:24:08,976",
        "eid": 135,
        "data": {
          "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1780046460318496 --launch-time-ticks=188647921 --skip-read-main-dll --metrics-shmem-handle=5152,i,4108351377575747650,13074092367968317022,2097152 --field-trial-handle=2292,i,10729465624520103307,2062822685409760543,262144 --variations-seed-version --pseudonymization-salt-handle=2296,i,15553667181084516343,5252397608772664425,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5392 /prefetch:1"
        }
      }
    ],
    "encryptedbuffers": [],
    "network_map": {
      "endpoint_map": {},
      "http_host_map": {},
      "dns_intents": {},
      "http_requests": [],
      "winhttp_sessions": [],
      "com_activations": []
    }
  },
  "debug": {
    "log": "2026-05-28 20:55:31,042 [root] INFO: Date set to: 20260529T05:23:56, timeout set to: 200\n2026-05-29 05:23:56,011 [root] DEBUG: Starting analyzer from: C:\\lpw_albt\n2026-05-29 05:23:56,012 [root] DEBUG: Storing results at: C:\\EsskdWmsyS\n2026-05-29 05:23:56,012 [root] DEBUG: Pipe server name: \\\\.\\PIPE\\HICbhmaojK\n2026-05-29 05:23:56,012 [root] DEBUG: Python path: C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64\n2026-05-29 05:23:56,012 [root] INFO: analysis running as an admin\n2026-05-29 05:23:56,012 [root] INFO: analysis package specified: \"edge\"\n2026-05-29 05:23:56,012 [root] DEBUG: importing analysis package module: \"modules.packages.edge\"...\n2026-05-29 05:23:56,018 [root] DEBUG: imported analysis package \"edge\"\n2026-05-29 05:23:56,019 [root] DEBUG: initializing analysis package \"edge\"...\n2026-05-29 05:23:56,019 [root] DEBUG: New location of moved file: g\n2026-05-29 05:23:56,019 [root] INFO: Analyzer: Package modules.packages.edge does not specify a dll option\n2026-05-29 05:23:56,020 [root] INFO: Analyzer: Package modules.packages.edge does not specify a dll_64 option\n2026-05-29 05:23:56,020 [root] INFO: Analyzer: Package modules.packages.edge does not specify a loader option\n2026-05-29 05:23:56,020 [root] INFO: Analyzer: Package modules.packages.edge does not specify a loader_64 option\n2026-05-29 05:23:56,101 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.browser\"\n2026-05-29 05:23:56,173 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.digisig\"\n2026-05-29 05:23:56,195 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.disguise\"\n2026-05-29 05:23:56,214 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.human\"\n2026-05-29 05:23:56,218 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'\n2026-05-29 05:23:56,220 [lib.api.screenshot] ERROR: No module named 'PIL'\n2026-05-29 05:23:56,221 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.screenshots\"\n2026-05-29 05:23:56,223 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.tlsdump\"\n2026-05-29 05:23:56,223 [root] DEBUG: Initialized auxiliary module \"Browser\"\n2026-05-29 05:23:56,224 [root] DEBUG: attempting to configure 'Browser' from data\n2026-05-29 05:23:56,224 [root] DEBUG: module Browser does not support data configuration, ignoring\n2026-05-29 05:23:56,224 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.browser\"...\n2026-05-29 05:23:56,225 [root] DEBUG: Started auxiliary module modules.auxiliary.browser\n2026-05-29 05:23:56,225 [root] DEBUG: Initialized auxiliary module \"DigiSig\"\n2026-05-29 05:23:56,225 [root] DEBUG: attempting to configure 'DigiSig' from data\n2026-05-29 05:23:56,226 [root] DEBUG: module DigiSig does not support data configuration, ignoring\n2026-05-29 05:23:56,226 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.digisig\"...\n2026-05-29 05:23:56,226 [modules.auxiliary.digisig] DEBUG: Skipping authenticode validation, analysis is not a file\n2026-05-29 05:23:56,226 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig\n2026-05-29 05:23:56,227 [root] DEBUG: Initialized auxiliary module \"Disguise\"\n2026-05-29 05:23:56,227 [root] DEBUG: attempting to configure 'Disguise' from data\n2026-05-29 05:23:56,227 [root] DEBUG: module Disguise does not support data configuration, ignoring\n2026-05-29 05:23:56,228 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.disguise\"...\n2026-05-29 05:23:56,241 [modules.auxiliary.disguise] INFO: Launched background process notepad.exe hidden (PID: 844)\n2026-05-29 05:23:56,242 [modules.auxiliary.disguise] INFO: Disguising GUID to 80438ff8-63a5-4e06-b69a-a7d9e7479144\n2026-05-29 05:23:56,242 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise\n2026-05-29 05:23:56,243 [root] DEBUG: Initialized auxiliary module \"Human\"\n2026-05-29 05:23:56,244 [root] DEBUG: attempting to configure 'Human' from data\n2026-05-29 05:23:56,245 [root] DEBUG: module Human does not support data configuration, ignoring\n2026-05-29 05:23:56,245 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.human\"...\n2026-05-29 05:23:56,246 [root] DEBUG: Started auxiliary module modules.auxiliary.human\n2026-05-29 05:23:56,247 [root] DEBUG: Initialized auxiliary module \"Screenshots\"\n2026-05-29 05:23:56,247 [root] DEBUG: attempting to configure 'Screenshots' from data\n2026-05-29 05:23:56,247 [root] DEBUG: module Screenshots does not support data configuration, ignoring\n2026-05-29 05:23:56,247 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.screenshots\"...\n2026-05-29 05:23:56,248 [modules.auxiliary.screenshots] WARNING: Python Image Library is not installed, screenshots are disabled\n2026-05-29 05:23:56,248 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots\n2026-05-29 05:23:56,248 [root] DEBUG: Initialized auxiliary module \"TLSDumpMasterSecrets\"\n2026-05-29 05:23:56,248 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data\n2026-05-29 05:23:56,248 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring\n2026-05-29 05:23:56,248 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.tlsdump\"...\n2026-05-29 05:23:56,252 [modules.auxiliary.tlsdump] WARNING: Unable to find lsass.exe process\n2026-05-29 05:23:56,253 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump\n2026-05-29 05:23:56,253 [root] INFO: Interactive mode enabled - injecting into explorer shell\n2026-05-29 05:23:56,387 [lib.api.process] INFO: Monitor config for process 4484: C:\\lpw_albt\\dll\\4484.ini\n2026-05-29 05:23:56,389 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 05:23:56,393 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\TQDMPSoj.dll, loader C:\\lpw_albt\\bin\\AqpBuwuB.exe\n2026-05-29 05:23:56,439 [root] DEBUG: Loader: Injecting process 4484 with C:\\lpw_albt\\dll\\TQDMPSoj.dll.\n2026-05-29 05:23:56,610 [root] DEBUG: 4484: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-29 05:23:56,613 [root] DEBUG: 4484: Disabling sleep skipping.\n2026-05-29 05:23:56,615 [root] DEBUG: 4484: Interactive desktop enabled.\n2026-05-29 05:23:56,616 [root] DEBUG: 4484: Dropped file limit defaulting to 100.\n2026-05-29 05:23:56,617 [root] DEBUG: 4484: Interactive desktop - injecting Explorer Shell\n2026-05-29 05:23:56,626 [root] DEBUG: 4484: YaraInit: Compiled 44 rule files\n2026-05-29 05:23:56,629 [root] DEBUG: 4484: YaraInit: Compiled rules saved to file C:\\lpw_albt\\data\\yara\\capemon.yac\n2026-05-29 05:23:56,684 [root] DEBUG: 4484: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0\n2026-05-29 05:23:56,687 [root] DEBUG: 4484: YaraScan: Scanning 0x00007FF79BC10000, size 0x545316\n2026-05-29 05:23:56,765 [root] DEBUG: 4484: Monitor initialised: 64-bit capemon loaded in process 4484 at 0x00007FFF17B10000, thread 6608, image base 0x00007FF79BC10000, stack from 0x0000000009051000-0x0000000009060000\n2026-05-29 05:23:56,767 [root] DEBUG: 4484: Commandline: C:\\Windows\\Explorer.EXE\n2026-05-29 05:23:56,781 [root] DEBUG: 4484: Hooked 69 out of 69 functions\n2026-05-29 05:23:56,815 [root] DEBUG: 4484: Syscall hook installed, syscall logging level 1\n2026-05-29 05:23:56,825 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.\n2026-05-29 05:23:56,827 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\TQDMPSoj.dll.\n2026-05-29 05:23:56,828 [lib.api.process] INFO: Injected into 64-bit <Process 4484 explorer.exe>\n2026-05-29 05:23:57,245 [root] DEBUG: 4484: caller_dispatch: Added region at 0x00007FF79BC10000 to tracked regions list (ntdll::NtCreateFile returns to 0x00007FF79BD27BE7, thread 4696).\n2026-05-29 05:23:57,246 [root] DEBUG: 4484: YaraScan: Scanning 0x00007FF79BC10000, size 0x545316\n2026-05-29 05:23:57,285 [root] DEBUG: 4484: ProcessImageBase: Main module image at 0x00007FF79BC10000 unmodified (entropy change 0.000000e+00)\n2026-05-29 05:24:03,973 [root] INFO: Restarting WMI Service\n2026-05-29 05:24:03,981 [root] DEBUG: package modules.packages.edge does not support configure, ignoring\n2026-05-29 05:24:03,982 [root] WARNING: configuration error for package modules.packages.edge: error importing data.packages.edge: No module named 'data.packages'\n2026-05-29 05:24:03,982 [lib.core.compound] INFO: C:\\Users\\admin\\AppData\\Local\\Temp already exists, skipping creation\n2026-05-29 05:24:03,983 [lib.api.process] INFO: Successfully executed process from path \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" with arguments \"\"g\"\" with pid 8412\n2026-05-29 05:24:03,983 [lib.api.process] INFO: Monitor config for process 8412: C:\\lpw_albt\\dll\\8412.ini\n2026-05-29 05:24:03,984 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 05:24:03,986 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\TQDMPSoj.dll, loader C:\\lpw_albt\\bin\\AqpBuwuB.exe\n2026-05-29 05:24:03,990 [root] DEBUG: Loader: Injecting process 8412 (thread 8244) with C:\\lpw_albt\\dll\\TQDMPSoj.dll.\n2026-05-29 05:24:03,990 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-29 05:24:03,991 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\TQDMPSoj.dll.\n2026-05-29 05:24:03,992 [lib.api.process] INFO: Injected into 64-bit <Process 8412 msedge.exe>\n2026-05-29 05:24:06,008 [lib.api.process] INFO: Successfully resumed process with pid 8412\n2026-05-29 05:24:06,053 [root] DEBUG: 8412: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-29 05:24:06,054 [root] DEBUG: 8412: Interactive desktop enabled.\n2026-05-29 05:24:06,054 [root] DEBUG: 8412: Dropped file limit defaulting to 100.\n2026-05-29 05:24:06,065 [root] DEBUG: 8412: Edge-specific hook-set enabled.\n2026-05-29 05:24:06,067 [root] DEBUG: 8412: Disabling sleep skipping.\n2026-05-29 05:24:06,068 [root] DEBUG: 8412: YaraInit: Compiled rules loaded from existing file C:\\lpw_albt\\data\\yara\\capemon.yac\n2026-05-29 05:24:06,080 [root] DEBUG: 8412: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0\n2026-05-29 05:24:06,081 [root] DEBUG: 8412: Monitor initialised: 64-bit capemon loaded in process 8412 at 0x00007FFF17B10000, thread 8244, image base 0x00007FF7F5380000, stack from 0x000000548D3F4000-0x000000548D400000\n2026-05-29 05:24:06,081 [root] DEBUG: 8412: Commandline: \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" \"g\"\n2026-05-29 05:24:06,092 [root] DEBUG: 8412: Hooked 2 out of 2 functions\n2026-05-29 05:24:06,146 [root] DEBUG: 8412: Syscall hook installed, syscall logging level 1\n2026-05-29 05:24:06,151 [root] DEBUG: 8412: RestoreHeaders: Restored original import table.\n2026-05-29 05:24:06,152 [root] INFO: Loaded monitor into process with pid 8412\n2026-05-29 05:24:06,160 [root] DEBUG: 8412: DLL loaded at 0x00007FFF57EF0000: C:\\Windows\\System32\\bcryptprimitives (0x82000 bytes).\n2026-05-29 05:24:06,168 [root] DEBUG: 8412: DLL loaded at 0x00007FFF43500000: C:\\Windows\\SYSTEM32\\version (0xa000 bytes).\n2026-05-29 05:24:06,169 [root] DEBUG: 8412: DLL loaded at 0x00007FFF58070000: C:\\Windows\\System32\\shcore (0xad000 bytes).\n2026-05-29 05:24:06,170 [root] DEBUG: 8412: DLL loaded at 0x00007FFF56FA0000: C:\\Windows\\SYSTEM32\\Wldp (0x2d000 bytes).\n2026-05-29 05:24:06,171 [root] DEBUG: 8412: DLL loaded at 0x00007FFF55710000: C:\\Windows\\SYSTEM32\\windows.storage (0x79b000 bytes).\n2026-05-29 05:24:06,172 [root] DEBUG: 8412: DLL loaded at 0x00007FFF58070000: C:\\Windows\\System32\\SHCORE (0xad000 bytes).\n2026-05-29 05:24:06,173 [root] DEBUG: 8412: DLL loaded at 0x00007FFF56770000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-29 05:24:06,320 [root] DEBUG: 8412: DLL loaded at 0x00007FFF453C0000: C:\\Windows\\SYSTEM32\\WINMM (0x27000 bytes).\n2026-05-29 05:24:06,323 [root] DEBUG: 8412: DLL loaded at 0x00007FFEFE540000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge (0x136be000 bytes).\n2026-05-29 05:24:06,331 [root] DEBUG: 8412: DLL loaded at 0x00007FFF45010000: C:\\Windows\\SYSTEM32\\KBDUS (0x9000 bytes).\n2026-05-29 05:24:06,340 [root] DEBUG: 8412: DLL loaded at 0x00007FFF54FC0000: C:\\Windows\\system32\\uxtheme (0x9e000 bytes).\n2026-05-29 05:24:06,350 [root] DEBUG: 8412: DLL loaded at 0x00007FFF55510000: C:\\Windows\\SYSTEM32\\kernel.appcore (0x12000 bytes).\n2026-05-29 05:24:06,351 [root] DEBUG: 8412: CreateProcessHandler: Injection info set for new process 408: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-29 05:24:06,351 [root] DEBUG: 8412: DLL loaded at 0x00007FFF58B30000: C:\\Windows\\System32\\clbcatq (0xa9000 bytes).\n2026-05-29 05:24:06,353 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 408\n2026-05-29 05:24:06,353 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 408\n2026-05-29 05:24:06,354 [root] DEBUG: 8412: DLL loaded at 0x00007FFF186F0000: C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings (0x16000 bytes).\n2026-05-29 05:24:06,355 [root] DEBUG: 8412: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-29 05:24:06,355 [root] DEBUG: 8412: DLL loaded at 0x00007FFF522D0000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-29 05:24:06,360 [root] DEBUG: 8412: DLL loaded at 0x00007FFF57520000: C:\\Windows\\SYSTEM32\\USERENV (0x2e000 bytes).\n2026-05-29 05:24:06,361 [root] DEBUG: 8412: DLL loaded at 0x00007FFF55EC0000: C:\\Windows\\SYSTEM32\\gpapi (0x23000 bytes).\n2026-05-29 05:24:06,362 [root] DEBUG: 8412: DLL loaded at 0x00007FFF56750000: C:\\Windows\\SYSTEM32\\wkscli (0x19000 bytes).\n2026-05-29 05:24:06,363 [root] DEBUG: 8412: DLL loaded at 0x00007FFF56A30000: C:\\Windows\\SYSTEM32\\netutils (0xc000 bytes).\n2026-05-29 05:24:06,363 [root] DEBUG: 8412: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-29 05:24:06,364 [root] DEBUG: 8412: DLL loaded at 0x00007FFF16930000: C:\\Windows\\SYSTEM32\\MDMRegistration (0x68000 bytes).\n2026-05-29 05:24:06,365 [root] DEBUG: 8412: DLL loaded at 0x00007FFF57490000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-29 05:24:06,366 [root] DEBUG: 8412: DLL loaded at 0x00007FFF56EF0000: C:\\Windows\\SYSTEM32\\CRYPTSP (0x18000 bytes).\n2026-05-29 05:24:06,366 [root] DEBUG: 8412: DLL loaded at 0x00007FFF57010000: C:\\Windows\\SYSTEM32\\ncrypt (0x27000 bytes).\n2026-05-29 05:24:06,367 [root] DEBUG: 8412: DLL loaded at 0x00007FFF59EF0000: C:\\Windows\\System32\\imagehlp (0x1d000 bytes).\n2026-05-29 05:24:06,369 [root] DEBUG: 8412: DLL loaded at 0x00007FFF4FA10000: C:\\Windows\\SYSTEM32\\tbs (0x1b000 bytes).\n2026-05-29 05:24:06,370 [root] DEBUG: 8412: DLL loaded at 0x00007FFF15300000: C:\\Windows\\SYSTEM32\\DMCmnUtils (0x7c000 bytes).\n2026-05-29 05:24:06,371 [root] DEBUG: 8412: DLL loaded at 0x00007FFF3F6A0000: C:\\Windows\\SYSTEM32\\omadmapi (0x3a000 bytes).\n2026-05-29 05:24:06,371 [root] DEBUG: 8412: DLL loaded at 0x00007FFF57470000: C:\\Windows\\SYSTEM32\\UMPDC (0x12000 bytes).\n2026-05-29 05:24:06,372 [root] DEBUG: 8412: DLL loaded at 0x00007FFF56FD0000: C:\\Windows\\SYSTEM32\\NTASN1 (0x3b000 bytes).\n2026-05-29 05:24:06,374 [root] DEBUG: 8412: DLL loaded at 0x00007FFF43550000: C:\\Windows\\SYSTEM32\\netapi32 (0x19000 bytes).\n2026-05-29 05:24:06,375 [root] DEBUG: 8412: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-29 05:24:06,375 [root] DEBUG: 8412: DLL loaded at 0x00007FFF56EF0000: C:\\Windows\\SYSTEM32\\cryptsp (0x18000 bytes).\n2026-05-29 05:24:06,376 [root] DEBUG: 8412: DLL loaded at 0x00007FFF52F20000: C:\\Windows\\SYSTEM32\\DSREG (0x141000 bytes).\n2026-05-29 05:24:06,378 [root] DEBUG: 8412: DLL loaded at 0x00007FFF57560000: C:\\Windows\\SYSTEM32\\profapi (0x25000 bytes).\n2026-05-29 05:24:06,406 [root] DEBUG: 8412: DLL loaded at 0x00007FFF4CFA0000: C:\\Windows\\System32\\AssignedAccessRuntime (0x14000 bytes).\n2026-05-29 05:24:06,408 [root] DEBUG: 8412: DLL loaded at 0x00007FFF58380000: C:\\Windows\\System32\\MSCTF (0x114000 bytes).\n2026-05-29 05:24:06,409 [root] DEBUG: 8412: DLL loaded at 0x00007FFF4D3D0000: C:\\Windows\\System32\\SystemSettings.DataModel (0x74000 bytes).\n2026-05-29 05:24:06,409 [root] DEBUG: 8412: DLL loaded at 0x00007FFF57490000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-29 05:24:06,410 [root] DEBUG: 8412: DLL loaded at 0x00007FFF57470000: C:\\Windows\\SYSTEM32\\UMPDC (0x12000 bytes).\n2026-05-29 05:24:06,411 [root] DEBUG: 8412: DLL loaded at 0x00007FFF49A90000: C:\\Windows\\SYSTEM32\\DWrite (0x27f000 bytes).\n2026-05-29 05:24:06,414 [root] DEBUG: 8412: DLL loaded at 0x00007FFF44D50000: C:\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\\COMCTL32 (0x29a000 bytes).\n2026-05-29 05:24:06,415 [root] DEBUG: 8412: DLL loaded at 0x00007FFF50870000: C:\\Windows\\System32\\OneCoreUAPCommonProxyStub (0x7d0000 bytes).\n2026-05-29 05:24:06,416 [root] DEBUG: 8412: DLL loaded at 0x00007FFF57350000: C:\\Windows\\SYSTEM32\\DPAPI (0xa000 bytes).\n2026-05-29 05:24:06,419 [root] DEBUG: 8412: DLL loaded at 0x00007FFF569F0000: C:\\Windows\\SYSTEM32\\IPHLPAPI (0x3b000 bytes).\n2026-05-29 05:24:06,420 [root] DEBUG: 8412: DLL loaded at 0x00007FFF52960000: C:\\Windows\\system32\\NLAapi (0x1d000 bytes).\n2026-05-29 05:24:06,423 [root] DEBUG: 8412: DLL loaded at 0x00007FFF58B20000: C:\\Windows\\System32\\NSI (0x8000 bytes).\n2026-05-29 05:24:06,424 [root] DEBUG: 8412: DLL loaded at 0x00007FFF57750000: C:\\Windows\\System32\\CFGMGR32 (0x4e000 bytes).\n2026-05-29 05:24:06,426 [root] DEBUG: 8412: DLL loaded at 0x00007FFF4B070000: C:\\Windows\\System32\\StructuredQuery (0xa6000 bytes).\n2026-05-29 05:24:06,429 [root] DEBUG: 8412: DLL loaded at 0x00007FFF515C0000: C:\\Windows\\SYSTEM32\\dhcpcsvc6 (0x17000 bytes).\n2026-05-29 05:24:06,433 [root] DEBUG: 8412: DLL loaded at 0x00007FFF52860000: C:\\Windows\\SYSTEM32\\PROPSYS (0xf6000 bytes).\n2026-05-29 05:24:06,435 [root] DEBUG: 8412: DLL loaded at 0x00007FFF515A0000: C:\\Windows\\SYSTEM32\\dhcpcsvc (0x1d000 bytes).\n2026-05-29 05:24:06,437 [root] DEBUG: 8412: DLL loaded at 0x00007FFF56A40000: C:\\Windows\\SYSTEM32\\DNSAPI (0xca000 bytes).\n2026-05-29 05:24:06,439 [root] DEBUG: 8412: DLL loaded at 0x00007FFF4CBF0000: C:\\Windows\\System32\\Windows.StateRepositoryPS (0x146000 bytes).\n2026-05-29 05:24:06,445 [root] DEBUG: 8412: DLL loaded at 0x00007FFF54850000: C:\\Windows\\System32\\CoreMessaging (0xf2000 bytes).\n2026-05-29 05:24:06,447 [root] DEBUG: 8412: DLL loaded at 0x00007FFF52DC0000: C:\\Windows\\SYSTEM32\\wintypes (0x155000 bytes).\n2026-05-29 05:24:06,447 [root] DEBUG: 8412: DLL loaded at 0x00007FFF54170000: C:\\Windows\\System32\\CoreUIComponents (0x35b000 bytes).\n2026-05-29 05:24:06,448 [root] DEBUG: 8412: DLL loaded at 0x00007FFF4B680000: C:\\Windows\\SYSTEM32\\textinputframework (0xf9000 bytes).\n2026-05-29 05:24:06,449 [root] DEBUG: 8412: DLL loaded at 0x00007FFF4CD70000: C:\\Windows\\system32\\Windows.Storage.Search (0xc6000 bytes).\n2026-05-29 05:24:06,452 [root] DEBUG: 8412: DLL loaded at 0x00007FFF517C0000: C:\\Windows\\System32\\twinapi.appcore (0x203000 bytes).\n2026-05-29 05:24:06,454 [root] DEBUG: 8412: DLL loaded at 0x00007FFF4CD40000: C:\\Windows\\system32\\mssprxy (0x28000 bytes).\n2026-05-29 05:24:06,454 [root] DEBUG: 8412: DLL loaded at 0x00007FFF45580000: C:\\Windows\\system32\\twinapi (0xa9000 bytes).\n2026-05-29 05:24:06,458 [root] DEBUG: 8412: DLL loaded at 0x00007FFF52420000: C:\\Windows\\SYSTEM32\\wevtapi (0x65000 bytes).\n2026-05-29 05:24:06,461 [root] DEBUG: 8412: DLL loaded at 0x00007FFF47AB0000: C:\\Windows\\SYSTEM32\\edputil (0x24000 bytes).\n2026-05-29 05:24:06,463 [root] DEBUG: 8412: DLL loaded at 0x00007FFF51A60000: C:\\Windows\\System32\\WindowManagementAPI (0xa1000 bytes).\n2026-05-29 05:24:06,463 [root] DEBUG: 8412: DLL loaded at 0x00007FFF4AF10000: C:\\Windows\\System32\\InputHost (0x152000 bytes).\n2026-05-29 05:24:06,464 [root] DEBUG: 8412: DLL loaded at 0x00007FFF4BFB0000: C:\\Windows\\System32\\Windows.UI (0x141000 bytes).\n2026-05-29 05:24:06,466 [root] DEBUG: 8412: DLL loaded at 0x00007FFF52B00000: C:\\Windows\\SYSTEM32\\WTSAPI32 (0x14000 bytes).\n2026-05-29 05:24:06,468 [root] DEBUG: 8412: DLL loaded at 0x00007FFF57360000: C:\\Windows\\SYSTEM32\\WINSTA (0x5b000 bytes).\n2026-05-29 05:24:06,469 [root] DEBUG: 8412: DLL loaded at 0x00007FFF4D6A0000: C:\\Windows\\System32\\iertutil (0x2bc000 bytes).\n2026-05-29 05:24:06,470 [root] DEBUG: 8412: DLL loaded at 0x00007FFF47980000: C:\\Windows\\System32\\Windows.Web (0xc3000 bytes).\n2026-05-29 05:24:06,476 [root] DEBUG: 8412: DLL loaded at 0x00007FFF515E0000: C:\\Windows\\SYSTEM32\\ColorAdapterClient (0x11000 bytes).\n2026-05-29 05:24:06,479 [root] DEBUG: 8412: DLL loaded at 0x00007FFF51600000: C:\\Windows\\SYSTEM32\\mscms (0xae000 bytes).\n2026-05-29 05:24:06,481 [root] DEBUG: 8412: DLL loaded at 0x00007FFF52560000: C:\\Windows\\SYSTEM32\\WINHTTP (0x10a000 bytes).\n2026-05-29 05:24:06,494 [root] DEBUG: 8412: DLL loaded at 0x00007FFF163D0000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\oneauth (0x5c4000 bytes).\n2026-05-29 05:24:06,499 [root] DEBUG: 8412: DLL loaded at 0x00007FFF49D10000: C:\\Windows\\System32\\Windows.UI.Immersive (0x139000 bytes).\n2026-05-29 05:24:06,500 [root] DEBUG: 8412: CreateProcessHandler: Injection info set for new process 3544: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-29 05:24:06,501 [root] DEBUG: 8412: DLL loaded at 0x00007FFF48330000: C:\\Windows\\SYSTEM32\\Secur32 (0xc000 bytes).\n2026-05-29 05:24:06,501 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 3544\n2026-05-29 05:24:06,502 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 3544\n2026-05-29 05:24:06,502 [root] DEBUG: 8412: caller_dispatch: Added region at 0x00007FF7F5380000 to tracked regions list (kernel32::CreateProcessInternalW returns to 0x00007FF7F5477D66, thread 6084).\n2026-05-29 05:24:06,506 [root] DEBUG: 8412: ProcessImageBase: Main module image at 0x00007FF7F5380000 unmodified (entropy change 0.000000e+00)\n2026-05-29 05:24:06,509 [root] DEBUG: 8412: CreateProcessHandler: Injection info set for new process 6176: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-29 05:24:06,510 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 6176\n2026-05-29 05:24:06,511 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 6176\n2026-05-29 05:24:06,512 [root] DEBUG: 8412: DLL loaded at 0x00007FFF573C0000: C:\\Windows\\SYSTEM32\\sxs (0xa2000 bytes).\n2026-05-29 05:24:06,533 [root] DEBUG: 8412: CreateProcessHandler: Injection info set for new process 3600: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-29 05:24:06,542 [root] DEBUG: 8412: DLL loaded at 0x00007FFF43590000: C:\\Windows\\SYSTEM32\\LINKINFO (0xd000 bytes).\n2026-05-29 05:24:06,549 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 3600\n2026-05-29 05:24:06,550 [root] DEBUG: 8412: DLL loaded at 0x00007FFF52490000: C:\\Windows\\SYSTEM32\\usermgrcli (0x16000 bytes).\n2026-05-29 05:24:06,551 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 3600\n2026-05-29 05:24:06,551 [root] DEBUG: 8412: DLL loaded at 0x00007FFF409A0000: C:\\Windows\\System32\\Windows.Internal.UI.Shell.WindowTabManager (0x6d000 bytes).\n2026-05-29 05:24:06,569 [root] DEBUG: 8412: DLL loaded at 0x00007FFF55EF0000: C:\\Windows\\system32\\dxgi (0xf3000 bytes).\n2026-05-29 05:24:06,570 [root] DEBUG: 8412: DLL loaded at 0x00007FFF53070000: C:\\Windows\\system32\\d3d11 (0x263000 bytes).\n2026-05-29 05:24:06,571 [root] DEBUG: 8412: DLL loaded at 0x00007FFF538A0000: C:\\Windows\\system32\\dcomp (0x1e3000 bytes).\n2026-05-29 05:24:06,572 [root] DEBUG: 8412: DLL loaded at 0x00007FFF43630000: C:\\Windows\\system32\\dataexchange (0x3e000 bytes).\n2026-05-29 05:24:06,597 [root] DEBUG: 8412: DLL loaded at 0x00007FFF3E230000: C:\\Windows\\System32\\Windows.System.Profile.RetailInfo (0x28000 bytes).\n2026-05-29 05:24:06,614 [root] DEBUG: 8412: DLL loaded at 0x00007FFF55220000: C:\\Windows\\SYSTEM32\\dwmapi (0x2f000 bytes).\n2026-05-29 05:24:06,622 [root] DEBUG: 8412: DLL loaded at 0x00007FFF43990000: C:\\Windows\\SYSTEM32\\OLEACC (0x66000 bytes).\n2026-05-29 05:24:06,623 [root] DEBUG: 8412: CreateProcessHandler: Injection info set for new process 6488: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-29 05:24:06,623 [root] DEBUG: 8412: CreateProcessHandler: Injection info set for new process 1380: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-29 05:24:06,624 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 6488\n2026-05-29 05:24:06,625 [root] DEBUG: 8412: DLL loaded at 0x00007FFF488B0000: C:\\Windows\\system32\\directmanipulation (0x9d000 bytes).\n2026-05-29 05:24:06,625 [root] DEBUG: \n2026-05-29 05:24:06,625 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 6488\n2026-05-29 05:24:06,626 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 1380\n2026-05-29 05:24:06,643 [root] DEBUG: 8412: DLL loaded at 0x00007FFF3EA70000: C:\\Windows\\System32\\Windows.Security.Authentication.OnlineId (0xf4000 bytes).\n2026-05-29 05:24:06,648 [root] DEBUG: 8412: DLL loaded at 0x00007FFF43550000: C:\\Windows\\SYSTEM32\\netapi32 (0x19000 bytes).\n2026-05-29 05:24:06,688 [root] DEBUG: 8412: DLL loaded at 0x00007FFF456D0000: C:\\Windows\\System32\\Windows.Security.Authentication.Web.Core (0x11d000 bytes).\n2026-05-29 05:24:06,698 [root] DEBUG: 8412: DLL loaded at 0x00007FFF3F8A0000: C:\\Windows\\SYSTEM32\\VCRUNTIME140 (0x1e000 bytes).\n2026-05-29 05:24:06,705 [root] DEBUG: 8412: DLL loaded at 0x00007FFF42BF0000: C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Domain Actions\\3.0.0.18\\domain_actions (0x17000 bytes).\n2026-05-29 05:24:06,730 [root] DEBUG: 8412: DLL loaded at 0x00007FFF162A0000: C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Well Known Domains\\1.2.0.0\\well_known_domains (0x9e000 bytes).\n2026-05-29 05:24:06,736 [root] DEBUG: 8412: DLL loaded at 0x00007FFF48780000: C:\\Windows\\System32\\OneCoreCommonProxyStub (0x7f000 bytes).\n2026-05-29 05:24:06,738 [root] DEBUG: 8412: DLL loaded at 0x00007FFF57130000: C:\\Windows\\SYSTEM32\\MSASN1 (0x12000 bytes).\n2026-05-29 05:24:06,738 [root] DEBUG: 8412: DLL loaded at 0x00007FFF3E730000: C:\\Windows\\System32\\vaultcli (0x51000 bytes).\n2026-05-29 05:24:06,746 [root] DEBUG: 8412: DLL loaded at 0x00007FFF56EF0000: C:\\Windows\\SYSTEM32\\CRYPTSP (0x18000 bytes).\n2026-05-29 05:24:06,751 [root] DEBUG: 8412: DLL loaded at 0x00007FFF56630000: C:\\Windows\\system32\\rsaenh (0x34000 bytes).\n2026-05-29 05:24:06,762 [root] DEBUG: 8412: DLL loaded at 0x00007FFF18730000: C:\\Windows\\System32\\aadWamExtension (0x36000 bytes).\n2026-05-29 05:24:06,788 [root] DEBUG: 8412: DLL loaded at 0x00007FFF15540000: C:\\Windows\\System32\\MicrosoftAccountWAMExtension (0x8c000 bytes).\n2026-05-29 05:24:07,977 [root] DEBUG: 8412: DLL loaded at 0x00007FFF3FD40000: C:\\Windows\\System32\\ShellCommonCommonProxyStub (0xe4000 bytes).\n2026-05-29 05:24:08,370 [root] DEBUG: 8412: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-29 05:24:08,371 [root] DEBUG: 8412: DLL loaded at 0x00007FFF522D0000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-29 05:24:08,974 [root] DEBUG: 8412: CreateProcessHandler: Injection info set for new process 9328: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-29 05:24:08,979 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 9328\n2026-05-29 05:24:08,982 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 9328\n2026-05-29 05:24:08,987 [root] DEBUG: 8412: DLL loaded at 0x00007FFF55410000: C:\\Windows\\System32\\RMCLIENT (0x2a000 bytes).\n2026-05-29 05:24:08,989 [root] DEBUG: 8412: DLL loaded at 0x00007FFF523E0000: C:\\Windows\\System32\\XmlLite (0x36000 bytes).\n2026-05-29 05:24:08,989 [root] DEBUG: 8412: DLL loaded at 0x00007FFF40FB0000: C:\\Windows\\System32\\wpnapps (0x15b000 bytes).\n2026-05-29 05:24:09,320 [root] DEBUG: 8412: CreateProcessHandler: Injection info set for new process 9432: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-29 05:24:09,324 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 9432\n2026-05-29 05:24:09,325 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 9432\n2026-05-29 05:24:10,039 [root] INFO: Process with pid 8412 appears to have terminated\n",
    "errors": []
  },
  "network": {
    "pcap_sha256": "931b0b6ee395d2341d3f59968462dfe3853d29b714fe4d24d60592417efb43ce",
    "hosts": [
      {
        "ip": "23.202.166.56",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "72.153.5.62",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "72.153.5.96",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "72.153.5.141",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "146.75.119.82",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "20.227.97.55",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "199.232.211.52",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "23.211.129.205",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "162.254.195.75",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "103.10.125.22",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          27018
        ]
      },
      {
        "ip": "23.216.106.59",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "api.steampowered.com",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "162.159.128.235",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "162.159.137.232",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "status.discord.com",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "162.159.135.232",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "status.discord.com",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "162.159.135.233",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "discordapp.com",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "162.159.133.233",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "discordapp.com",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "162.159.134.234",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "gateway-us-east1-c.discord.gg",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "162.159.135.234",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "gateway-us-east1-c.discord.gg",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "142.251.222.3",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "c.pki.goog",
        "inaddrarpa": "",
        "ports": [
          80
        ]
      },
      {
        "ip": "172.172.255.218",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "23.221.49.11",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "steamconnecttest.com",
        "inaddrarpa": "",
        "ports": [
          80
        ]
      },
      {
        "ip": "199.232.215.52",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "103.10.125.23",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          27018
        ]
      }
    ],
    "domains": [
      {
        "domain": "api.steampowered.com",
        "ip": "23.216.106.59"
      },
      {
        "domain": "ipv6check-udp.steamserver.net",
        "ip": ""
      },
      {
        "domain": "ipv6check-http.steamserver.net",
        "ip": ""
      },
      {
        "domain": "steamconnecttest.com",
        "ip": "23.56.110.51"
      },
      {
        "domain": "c.pki.goog",
        "ip": "142.250.207.3"
      },
      {
        "domain": "gateway-us-east1-c.discord.gg",
        "ip": "162.159.130.234"
      },
      {
        "domain": "discordapp.com",
        "ip": "162.159.130.233"
      },
      {
        "domain": "status.discord.com",
        "ip": "162.159.137.232"
      },
      {
        "domain": "google.com",
        "ip": "142.250.195.142"
      },
      {
        "domain": "cdn.discordapp.com",
        "ip": "162.159.130.233"
      },
      {
        "domain": "updates.discord.com",
        "ip": "162.159.128.233"
      },
      {
        "domain": "p2p-syd1.discovery.steamserver.net",
        "ip": "103.10.125.42"
      },
      {
        "domain": "dns.google",
        "ip": "8.8.8.8"
      }
    ],
    "tcp": [
      {
        "src": "192.168.1.105",
        "sport": 49716,
        "dst": "103.10.125.23",
        "dport": 27018,
        "offset": 24,
        "time": 0.0
      },
      {
        "src": "192.168.1.105",
        "sport": 49729,
        "dst": "199.232.215.52",
        "dport": 443,
        "offset": 314,
        "time": 0.3392009735107422
      },
      {
        "src": "192.168.1.105",
        "sport": 49754,
        "dst": "23.221.49.11",
        "dport": 80,
        "offset": 1844,
        "time": 0.9604659080505371
      },
      {
        "src": "192.168.1.105",
        "sport": 49732,
        "dst": "172.172.255.218",
        "dport": 443,
        "offset": 2208,
        "time": 0.9686939716339111
      },
      {
        "src": "192.168.1.105",
        "sport": 49756,
        "dst": "52.123.129.14",
        "dport": 443,
        "offset": 4310,
        "time": 1.0333318710327148
      },
      {
        "src": "192.168.1.105",
        "sport": 49758,
        "dst": "199.232.214.172",
        "dport": 80,
        "offset": 24433,
        "time": 1.1288819313049316
      },
      {
        "src": "192.168.1.105",
        "sport": 49760,
        "dst": "104.115.81.8",
        "dport": 443,
        "offset": 27358,
        "time": 1.1930608749389648
      },
      {
        "src": "192.168.1.105",
        "sport": 49680,
        "dst": "172.172.255.218",
        "dport": 443,
        "offset": 31239,
        "time": 1.2355539798736572
      },
      {
        "src": "192.168.1.105",
        "sport": 49762,
        "dst": "142.251.222.3",
        "dport": 80,
        "offset": 32161,
        "time": 1.2456488609313965
      },
      {
        "src": "192.168.1.105",
        "sport": 49764,
        "dst": "40.126.14.164",
        "dport": 443,
        "offset": 48517,
        "time": 1.3668138980865479
      },
      {
        "src": "192.168.1.105",
        "sport": 49767,
        "dst": "20.42.179.204",
        "dport": 443,
        "offset": 154444,
        "time": 2.2647008895874023
      },
      {
        "src": "192.168.1.105",
        "sport": 49769,
        "dst": "20.42.179.204",
        "dport": 443,
        "offset": 184831,
        "time": 3.331631898880005
      },
      {
        "src": "192.168.1.105",
        "sport": 49772,
        "dst": "142.250.195.142",
        "dport": 443,
        "offset": 186501,
        "time": 3.4777019023895264
      },
      {
        "src": "192.168.1.105",
        "sport": 49771,
        "dst": "13.89.179.10",
        "dport": 443,
        "offset": 290232,
        "time": 3.597087860107422
      },
      {
        "src": "192.168.1.105",
        "sport": 49776,
        "dst": "40.74.79.222",
        "dport": 443,
        "offset": 2626451,
        "time": 4.802191972732544
      },
      {
        "src": "192.168.1.105",
        "sport": 49777,
        "dst": "20.42.179.204",
        "dport": 443,
        "offset": 2650930,
        "time": 5.114084005355835
      },
      {
        "src": "192.168.1.105",
        "sport": 49779,
        "dst": "13.89.179.10",
        "dport": 443,
        "offset": 2659504,
        "time": 5.4777398109436035
      },
      {
        "src": "192.168.1.105",
        "sport": 49702,
        "dst": "162.159.135.234",
        "dport": 443,
        "offset": 2690629,
        "time": 9.353335857391357
      },
      {
        "src": "192.168.1.105",
        "sport": 49783,
        "dst": "134.33.4.18",
        "dport": 443,
        "offset": 2700367,
        "time": 10.56650686264038
      },
      {
        "src": "192.168.1.105",
        "sport": 49784,
        "dst": "162.159.134.234",
        "dport": 443,
        "offset": 2718451,
        "time": 10.89996600151062
      },
      {
        "src": "192.168.1.105",
        "sport": 49728,
        "dst": "162.159.133.233",
        "dport": 443,
        "offset": 2735805,
        "time": 11.506353855133057
      },
      {
        "src": "192.168.1.105",
        "sport": 49785,
        "dst": "162.159.135.233",
        "dport": 443,
        "offset": 2738627,
        "time": 11.574355840682983
      },
      {
        "src": "192.168.1.105",
        "sport": 49787,
        "dst": "150.171.22.17",
        "dport": 443,
        "offset": 2751147,
        "time": 11.690963983535767
      },
      {
        "src": "192.168.1.105",
        "sport": 49789,
        "dst": "4.200.105.68",
        "dport": 443,
        "offset": 2773429,
        "time": 11.714563846588135
      },
      {
        "src": "192.168.1.105",
        "sport": 49791,
        "dst": "150.171.27.11",
        "dport": 443,
        "offset": 2817675,
        "time": 11.765177965164185
      },
      {
        "src": "192.168.1.105",
        "sport": 49793,
        "dst": "74.178.240.51",
        "dport": 443,
        "offset": 2874461,
        "time": 12.777395009994507
      },
      {
        "src": "192.168.1.105",
        "sport": 49795,
        "dst": "13.89.179.10",
        "dport": 443,
        "offset": 2905266,
        "time": 13.443651914596558
      },
      {
        "src": "192.168.1.105",
        "sport": 49797,
        "dst": "162.159.137.232",
        "dport": 443,
        "offset": 2947775,
        "time": 14.220014810562134
      },
      {
        "src": "192.168.1.105",
        "sport": 49798,
        "dst": "150.171.27.11",
        "dport": 443,
        "offset": 2965045,
        "time": 14.462486028671265
      },
      {
        "src": "192.168.1.105",
        "sport": 49801,
        "dst": "150.171.27.11",
        "dport": 443,
        "offset": 3019276,
        "time": 14.580396890640259
      },
      {
        "src": "192.168.1.105",
        "sport": 49731,
        "dst": "162.159.128.235",
        "dport": 443,
        "offset": 3069895,
        "time": 14.805100917816162
      },
      {
        "src": "192.168.1.105",
        "sport": 49803,
        "dst": "23.216.106.59",
        "dport": 443,
        "offset": 3074517,
        "time": 18.4942729473114
      },
      {
        "src": "192.168.1.105",
        "sport": 49804,
        "dst": "103.10.125.22",
        "dport": 27018,
        "offset": 3112738,
        "time": 18.79023289680481
      },
      {
        "src": "192.168.1.105",
        "sport": 49805,
        "dst": "103.10.125.23",
        "dport": 443,
        "offset": 3113325,
        "time": 18.79027795791626
      },
      {
        "src": "192.168.1.105",
        "sport": 49806,
        "dst": "103.10.125.23",
        "dport": 27018,
        "offset": 3113912,
        "time": 18.791534900665283
      },
      {
        "src": "192.168.1.105",
        "sport": 49807,
        "dst": "162.254.195.75",
        "dport": 443,
        "offset": 3162152,
        "time": 18.899122953414917
      },
      {
        "src": "192.168.1.105",
        "sport": 49811,
        "dst": "162.159.61.3",
        "dport": 443,
        "offset": 3193966,
        "time": 19.46769690513611
      },
      {
        "src": "192.168.1.105",
        "sport": 49809,
        "dst": "8.8.4.4",
        "dport": 443,
        "offset": 3214818,
        "time": 19.47300100326538
      }
    ],
    "udp": [
      {
        "src": "192.168.1.105",
        "sport": 60828,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 567,
        "time": 0.41373300552368164
      },
      {
        "src": "192.168.1.105",
        "sport": 65442,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 1386,
        "time": 0.78926682472229
      },
      {
        "src": "192.168.1.105",
        "sport": 54259,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 2948,
        "time": 1.0067479610443115
      },
      {
        "src": "192.168.1.105",
        "sport": 61830,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 28338,
        "time": 1.2015109062194824
      },
      {
        "src": "192.168.1.105",
        "sport": 54491,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 40465,
        "time": 1.3099849224090576
      },
      {
        "src": "192.168.1.105",
        "sport": 51258,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 88634,
        "time": 1.7990529537200928
      },
      {
        "src": "192.168.1.105",
        "sport": 62646,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 186057,
        "time": 3.4296088218688965
      },
      {
        "src": "192.168.1.105",
        "sport": 138,
        "dst": "192.168.1.255",
        "dport": 138,
        "offset": 1953979,
        "time": 4.099319934844971
      },
      {
        "src": "192.168.1.105",
        "sport": 55397,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 2689711,
        "time": 9.254822015762329
      },
      {
        "src": "192.168.1.105",
        "sport": 53996,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 2703515,
        "time": 10.854020833969116
      },
      {
        "src": "192.168.1.105",
        "sport": 59554,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 2737829,
        "time": 11.527354955673218
      },
      {
        "src": "192.168.1.105",
        "sport": 52776,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 2745775,
        "time": 11.64622688293457
      },
      {
        "src": "192.168.1.105",
        "sport": 137,
        "dst": "192.168.1.255",
        "dport": 137,
        "offset": 2746457,
        "time": 11.65412187576294
      },
      {
        "src": "192.168.1.105",
        "sport": 5353,
        "dst": "224.0.0.251",
        "dport": 5353,
        "offset": 2746565,
        "time": 11.654330015182495
      },
      {
        "src": "192.168.1.105",
        "sport": 49432,
        "dst": "224.0.0.252",
        "dport": 5355,
        "offset": 2746648,
        "time": 11.654656887054443
      },
      {
        "src": "192.168.1.105",
        "sport": 58954,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 2746822,
        "time": 11.663493871688843
      },
      {
        "src": "192.168.1.105",
        "sport": 57045,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 2747207,
        "time": 11.665859937667847
      },
      {
        "src": "192.168.1.105",
        "sport": 55395,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 2747690,
        "time": 11.669627904891968
      },
      {
        "src": "192.168.1.105",
        "sport": 60319,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 2773341,
        "time": 11.71429181098938
      },
      {
        "src": "192.168.1.105",
        "sport": 57070,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 2787916,
        "time": 11.735803842544556
      },
      {
        "src": "192.168.1.105",
        "sport": 61022,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 2846013,
        "time": 12.04092001914978
      },
      {
        "src": "192.168.1.105",
        "sport": 52943,
        "dst": "162.159.135.232",
        "dport": 443,
        "offset": 2847058,
        "time": 12.064876794815063
      },
      {
        "src": "192.168.1.105",
        "sport": 64269,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 2926276,
        "time": 13.980093002319336
      },
      {
        "src": "192.168.1.105",
        "sport": 53417,
        "dst": "104.115.81.8",
        "dport": 443,
        "offset": 2926652,
        "time": 14.010818004608154
      },
      {
        "src": "192.168.1.105",
        "sport": 58854,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 2937074,
        "time": 14.169520854949951
      },
      {
        "src": "192.168.1.105",
        "sport": 51777,
        "dst": "162.159.135.233",
        "dport": 443,
        "offset": 2938971,
        "time": 14.194386959075928
      },
      {
        "src": "192.168.1.105",
        "sport": 58865,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 2959176,
        "time": 14.432227849960327
      },
      {
        "src": "192.168.1.105",
        "sport": 50335,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 2959367,
        "time": 14.432814836502075
      },
      {
        "src": "192.168.1.105",
        "sport": 56679,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 2959640,
        "time": 14.434953927993774
      },
      {
        "src": "192.168.1.105",
        "sport": 65004,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 2959822,
        "time": 14.445698022842407
      },
      {
        "src": "192.168.1.105",
        "sport": 49162,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 3074005,
        "time": 18.31973695755005
      },
      {
        "src": "192.168.1.105",
        "sport": 60466,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 3170826,
        "time": 19.429791927337646
      },
      {
        "src": "192.168.1.105",
        "sport": 64614,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 3171013,
        "time": 19.43018388748169
      },
      {
        "src": "192.168.1.105",
        "sport": 49369,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 3171200,
        "time": 19.430657863616943
      },
      {
        "src": "192.168.1.105",
        "sport": 58275,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 3171387,
        "time": 19.431418895721436
      },
      {
        "src": "192.168.1.105",
        "sport": 49396,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 3171574,
        "time": 19.431991815567017
      },
      {
        "src": "192.168.1.105",
        "sport": 53846,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 3171761,
        "time": 19.432326793670654
      },
      {
        "src": "192.168.1.105",
        "sport": 60698,
        "dst": "172.64.41.3",
        "dport": 443,
        "offset": 3175922,
        "time": 19.456885814666748
      },
      {
        "src": "192.168.1.105",
        "sport": 52715,
        "dst": "162.159.61.3",
        "dport": 443,
        "offset": 3181799,
        "time": 19.458770990371704
      },
      {
        "src": "192.168.1.105",
        "sport": 27036,
        "dst": "192.168.1.255",
        "dport": 27036,
        "offset": 3265263,
        "time": 20.21087098121643
      }
    ],
    "icmp": [],
    "http": [
      {
        "count": 1,
        "host": "steamconnecttest.com",
        "port": 80,
        "data": "GET /204 HTTP/1.1\r\nCache-Control: no-cache\r\nHost: steamconnecttest.com\r\nAccept: text/html,*/*;q=0.9\r\naccept-encoding: gzip,identity,*;q=0\r\naccept-charset: ISO-8859-1,utf-8,*;q=0.7\r\nuser-agent: Valve/Steam HTTP Client 1.0\r\n\r\n",
        "uri": "http://steamconnecttest.com/204",
        "body": "",
        "path": "/204",
        "user-agent": "Valve/Steam HTTP Client 1.0",
        "version": "1.1",
        "method": "GET",
        "first_seen": 1780032237.934407
      },
      {
        "count": 1,
        "host": "c.pki.goog",
        "port": 80,
        "data": "GET /r/r1.crl HTTP/1.1\r\nCache-Control: max-age = 3000\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMT\r\nUser-Agent: Microsoft-CryptoAPI/10.0\r\nHost: c.pki.goog\r\n\r\n",
        "uri": "http://c.pki.goog/r/r1.crl",
        "body": "",
        "path": "/r/r1.crl",
        "user-agent": "Microsoft-CryptoAPI/10.0",
        "version": "1.1",
        "method": "GET",
        "first_seen": 1780032238.21959
      }
    ],
    "dns": [
      {
        "request": "api.steampowered.com",
        "type": "A",
        "answers": [
          {
            "type": "A",
            "data": "23.216.106.59"
          }
        ],
        "first_seen": 1780032237.26838
      },
      {
        "request": "ipv6check-udp.steamserver.net",
        "type": "AAAA",
        "answers": [
          {
            "type": "CNAME",
            "data": "udp.ipv6check.akadns.net"
          },
          {
            "type": "AAAA",
            "data": "2404:3fc0:1:102::670a:7d36"
          },
          {
            "type": "AAAA",
            "data": "2404:3fc0:1:102::670a:7d37"
          },
          {
            "type": "AAAA",
            "data": "2404:3fc0:1:100::670a:7d06"
          },
          {
            "type": "AAAA",
            "data": "2404:3fc0:1:100::42"
          },
          {
            "type": "AAAA",
            "data": "2404:3fc0:1:102::670a:7d38"
          },
          {
            "type": "CNAME",
            "data": "syd.udp.ipv6check.akadns.net"
          },
          {
            "type": "AAAA",
            "data": "2404:3fc0:1:100::670a:7d08"
          },
          {
            "type": "AAAA",
            "data": "2404:3fc0:1:102::670a:7d35"
          },
          {
            "type": "AAAA",
            "data": "2404:3fc0:1:100::32"
          }
        ],
        "first_seen": 1780032237.387674
      },
      {
        "request": "ipv6check-http.steamserver.net",
        "type": "A",
        "answers": [
          {
            "type": "CNAME",
            "data": "http.ipv6check.akadns.net"
          },
          {
            "type": "CNAME",
            "data": "syd.http.ipv6check.akadns.net"
          }
        ],
        "first_seen": 1780032237.602441
      },
      {
        "request": "steamconnecttest.com",
        "type": "A",
        "answers": [
          {
            "type": "A",
            "data": "23.221.49.11"
          },
          {
            "type": "A",
            "data": "23.221.49.17"
          }
        ],
        "first_seen": 1780032237.763208
      },
      {
        "request": "c.pki.goog",
        "type": "A",
        "answers": [
          {
            "type": "CNAME",
            "data": "pki-goog.l.google.com"
          },
          {
            "type": "A",
            "data": "142.251.222.3"
          }
        ],
        "first_seen": 1780032238.175452
      },
      {
        "request": "gateway-us-east1-c.discord.gg",
        "type": "A",
        "answers": [
          {
            "type": "A",
            "data": "162.159.130.234"
          },
          {
            "type": "A",
            "data": "162.159.134.234"
          },
          {
            "type": "A",
            "data": "162.159.135.234"
          },
          {
            "type": "A",
            "data": "162.159.133.234"
          },
          {
            "type": "A",
            "data": "162.159.136.234"
          }
        ],
        "first_seen": 1780032247.827962
      },
      {
        "request": "discordapp.com",
        "type": "A",
        "answers": [
          {
            "type": "A",
            "data": "162.159.135.233"
          },
          {
            "type": "A",
            "data": "162.159.134.233"
          },
          {
            "type": "A",
            "data": "162.159.133.233"
          },
          {
            "type": "A",
            "data": "162.159.129.233"
          },
          {
            "type": "A",
            "data": "162.159.130.233"
          }
        ],
        "first_seen": 1780032248.501296
      },
      {
        "request": "status.discord.com",
        "type": "A",
        "answers": [
          {
            "type": "A",
            "data": "162.159.128.233"
          },
          {
            "type": "A",
            "data": "162.159.138.232"
          },
          {
            "type": "A",
            "data": "162.159.137.232"
          },
          {
            "type": "A",
            "data": "162.159.135.232"
          },
          {
            "type": "A",
            "data": "162.159.136.232"
          }
        ],
        "first_seen": 1780032249.014861
      },
      {
        "request": "google.com",
        "type": "A",
        "answers": [
          {
            "type": "A",
            "data": "142.251.42.110"
          },
          {
            "type": "A",
            "data": "142.250.183.46"
          }
        ],
        "first_seen": 1780032250.954034
      },
      {
        "request": "cdn.discordapp.com",
        "type": "A",
        "answers": [],
        "first_seen": 1780032251.143278
      },
      {
        "request": "updates.discord.com",
        "type": "A",
        "answers": [],
        "first_seen": 1780032251.150943
      },
      {
        "request": "p2p-syd1.discovery.steamserver.net",
        "type": "A",
        "answers": [
          {
            "type": "A",
            "data": "103.10.125.24"
          },
          {
            "type": "A",
            "data": "103.10.125.42"
          }
        ],
        "first_seen": 1780032256.372082
      },
      {
        "request": "dns.google",
        "type": "A",
        "answers": [
          {
            "type": "A",
            "data": "8.8.4.4"
          },
          {
            "type": "A",
            "data": "8.8.8.8"
          }
        ],
        "first_seen": 1780032256.403733
      }
    ],
    "smtp": [],
    "irc": [],
    "dead_hosts": [
      [
        "72.153.5.141",
        443
      ],
      [
        "72.153.5.62",
        443
      ],
      [
        "72.153.5.96",
        443
      ]
    ]
  },
  "url": {
    "whois": "Name: None\nCountry: None\nState: None\nCity: None\nZIP Code: None\nAddress: None\n\nOrginization: None\nDomain Name(s):\n    None\nCreation Date:\n    None\nUpdated Date:\n    None\nExpiration Date:\n    None\nEmail(s):\n    None\n\nRegistrar(s):\n    None\nName Server(s):\n    None\nReferral URL(s):\n    None",
    "virustotal": {
      "error": true,
      "msg": "Unable to complete connection to VirusTotal. Status code: 429"
    }
  },
  "target": {
    "category": "url"
  },
  "url_analysis": {
    "url": "g"
  },
  "procmemory": [],
  "signatures": [
    {
      "name": "stealth_network",
      "description": "Network activity detected but not expressed in monitor API logs",
      "categories": [
        "stealth"
      ],
      "severity": 1,
      "weight": 1,
      "confidence": 100,
      "references": [],
      "data": [
        {
          "ip": "23.202.166.56"
        },
        {
          "ip": "72.153.5.62"
        },
        {
          "ip": "72.153.5.96"
        },
        {
          "ip": "72.153.5.141"
        },
        {
          "ip": "146.75.119.82"
        },
        {
          "ip": "20.227.97.55"
        },
        {
          "ip": "199.232.211.52"
        },
        {
          "ip": "23.211.129.205"
        },
        {
          "ip": "162.254.195.75"
        },
        {
          "ip": "103.10.125.22"
        },
        {
          "ip": "23.216.106.59"
        },
        {
          "ip": "162.159.128.235"
        },
        {
          "ip": "162.159.137.232"
        },
        {
          "ip": "162.159.135.232"
        },
        {
          "ip": "162.159.135.233"
        },
        {
          "ip": "162.159.133.233"
        },
        {
          "ip": "162.159.134.234"
        },
        {
          "ip": "162.159.135.234"
        },
        {
          "ip": "142.251.222.3"
        },
        {
          "ip": "172.172.255.218"
        },
        {
          "ip": "23.221.49.11"
        },
        {
          "ip": "199.232.215.52"
        },
        {
          "ip": "103.10.125.23"
        },
        {
          "domain": "api.steampowered.com"
        },
        {
          "domain": "ipv6check-udp.steamserver.net"
        },
        {
          "domain": "ipv6check-http.steamserver.net"
        },
        {
          "domain": "steamconnecttest.com"
        },
        {
          "domain": "c.pki.goog"
        },
        {
          "domain": "gateway-us-east1-c.discord.gg"
        },
        {
          "domain": "discordapp.com"
        },
        {
          "domain": "status.discord.com"
        },
        {
          "domain": "google.com"
        },
        {
          "domain": "cdn.discordapp.com"
        },
        {
          "domain": "updates.discord.com"
        },
        {
          "domain": "p2p-syd1.discovery.steamserver.net"
        },
        {
          "domain": "dns.google"
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "accesses_public_folder",
      "description": "A file was accessed within the Public folder.",
      "categories": [
        "generic"
      ],
      "severity": 1,
      "weight": 1,
      "confidence": 100,
      "references": [],
      "data": [
        {
          "file": "C:\\Users\\Public\\Desktop"
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "dllload_suspicious_directory",
      "description": "A DLL was loaded from a suspicious directory",
      "categories": [
        "side loading"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 50,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 8412,
          "cid": 125
        },
        {
          "suspicious_dll_load": "Process msedge.exe loaded a DLL from a suspicious directory, this is possibly indicative of DLL side loading/search order hijacking"
        },
        {
          "type": "call",
          "pid": 8412,
          "cid": 126
        },
        {
          "suspicious_dll_load": "Process msedge.exe loaded a DLL from a suspicious directory, this is possibly indicative of DLL side loading/search order hijacking"
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "creates_suspended_process",
      "description": "Creates a process in a suspended state, likely for injection",
      "categories": [
        "injection",
        "process hollowing"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 50,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 8412,
          "cid": 102
        },
        {
          "type": "call",
          "pid": 8412,
          "cid": 108
        },
        {
          "type": "call",
          "pid": 8412,
          "cid": 119
        },
        {
          "type": "call",
          "pid": 8412,
          "cid": 120
        },
        {
          "type": "call",
          "pid": 8412,
          "cid": 140
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    }
  ],
  "malscore": 2.0,
  "ttps": [
    {
      "signature": "stealth_network",
      "ttps": [
        "T1071"
      ],
      "mbcs": [
        "OC0006",
        "C0002",
        "OC0006",
        "C0002",
        "OC0006",
        "C0002",
        "OC0006",
        "C0002"
      ]
    },
    {
      "signature": "dllload_suspicious_directory",
      "ttps": [
        "T1574"
      ],
      "mbcs": [
        "F0015"
      ]
    },
    {
      "signature": "creates_suspended_process",
      "ttps": [
        "T1055"
      ],
      "mbcs": [
        "OC0006",
        "C0002",
        "OC0006",
        "C0002",
        "OC0006",
        "C0002",
        "OC0006",
        "C0002"
      ]
    },
    {
      "signature": "accesses_public_folder",
      "ttps": [
        "T1548",
        "T1036"
      ],
      "mbcs": []
    }
  ],
  "malstatus": "Clean"
}